An endpoint in Emissary’s configuration API (/api/configuration/{name}) validated the configuration name using a blacklist that blocked characters such as backslashes, forward slashes, and double periods. Because the blacklist could be bypassed by using URL‑encoded, double‑encoded, or Unicode‑normalized strings, an attacker could supply a crafted name that resolves to a file outside the intended configuration directory, allowing them to read arbitrary configuration files and thereby compromising confidentiality.

The vulnerability affects National Security Agency Emissary versions earlier than 8.39.0. Any installation that has not been updated to 8.39.0 or later exposes the /api/configuration/{name} endpoint to this risk.

The CVSS score of 5.3 indicates a moderate severity level, and according to the data there is no EPSS score or KEV listing. Based on the description, it is inferred that the attack requires an attacker to send an HTTP request to the vulnerable endpoint. If the endpoint is reachable by untrusted users or publicly exposed, the attacker could then execute a path traversal and read configuration files, resulting in moderate risk due to potential confidentiality damage.