CVE-2026-125659: Information Disclosure Vulnerability in eMudhra emBridge
This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authorization. An unauthenticated attacker on the same LAN could exploit this vulnerability by sending malicious webpage to the local HTTPS Web API.
Successful exploitation of this vulnerability could allow the attacker to enumerate file and directory names and obtain information about the directory structure of the targeted system.
The vulnerability however, does not provide access to file contents or permit file modification, deletion, or code execution, or access to cryptographic keys and hardware token PINs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
eMudhra emBridge for Red Hat (x64)to a version that resolves this vulnerability.Fixed in 3.3.1.x - Upgrade
Upgrade
eMudhra emBridge for Ubuntu (x64)to a version that resolves this vulnerability.Fixed in 3.3.1.x - Upgrade
Upgrade
eMudhra emBridge for Windowsto a version that resolves this vulnerability.Fixed in 5.9.4.x - Upgrade
Upgrade
eMudhra emBridge for macOS (x64)to a version that resolves this vulnerability.Fixed in 3.2.7.x
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Systems running the affected local HTTPS Web API are exposed to an unauthenticated attacker on the same LAN. Exploitation requires the attacker to send a malicious webpage to that API.
What information can an attacker obtain?
An attacker can enumerate file and directory names and learn the targeted system's directory structure. The issue does not provide file-content access or allow modification, deletion, or code execution.
Are cryptographic keys, hardware tokens, or PINs exposed?
No. The vulnerability does not provide access to cryptographic keys or hardware token PINs.