{"action":"Upgrade gov.nsa.emissary:emissary to 8.39.0 or later.","affected":[{"fixed":"8.39.0","introduced":"0"}],"component":"gov.nsa.emissary:emissary","cve_ids":["CVE-2026-35583"],"ecosystem":"Maven","epss":0.0032,"exploited":false,"fixed_versions":["8.39.0"],"ghsa_id":"GHSA-hxf2-gm22-7vcm","id":"tcs_01M5N91KZJR1YN8K26J5VHPG0A","modified_at":"2026-04-08T00:27:17.482740Z","published_at":"2026-04-08T00:12:55Z","references":["https://osv.dev/vulnerability/GHSA-hxf2-gm22-7vcm","https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-hxf2-gm22-7vcm","https://nvd.nist.gov/vuln/detail/CVE-2026-35583","https://github.com/NationalSecurityAgency/emissary/pull/1292","https://github.com/NationalSecurityAgency/emissary"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-hxf2-gm22-7vcm","url":"https://osv.dev/vulnerability/GHSA-hxf2-gm22-7vcm"}],"summary":"Emissary has a Path Traversal via Blacklist Bypass in Configuration API"}