CVE-2026-125659
Received
Received - Intake
Path Traversal in eMudhra emBridge FileBrowser API
Vulnerability report for CVE-2026-125659, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-13
Last updated on: 2026-11-13
Assigner: Indian Computer Emergency Response Team (CERT-In)
Description
Description
This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authorization. An unauthenticated attacker on the same LAN could exploit this vulnerability by sending malicious webpage to the local HTTPS Web API.
Successful exploitation of this vulnerability could allow the attacker to enumerate file and directory names and obtain information about the directory structure of the targeted system.
The vulnerability however, does not provide access to file contents or permit file modification, deletion, or code execution, or access to cryptographic keys and hardware token PINs.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
