CVE-2026-125659

Description

This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authorization. An unauthenticated attacker on the same LAN could exploit this vulnerability by sending malicious webpage to the local HTTPS Web API. Successful exploitation of this vulnerability could allow the attacker to enumerate file and directory names and obtain information about the directory structure of the targeted system. The vulnerability however, does not provide access to file contents or permit file modification, deletion, or code execution, or access to cryptographic keys and hardware token PINs.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 2.1CVSS 4.0, Lowfrom the CNA (CERT-In)CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What to do

• Upgrade eMudhra emBridge to latest versions: • eMudhra emBridge for Windows to version 5.9.4.x or later • eMudhra emBridge for macOS (x64) to version 3.2.7.x or later • eMudhra emBridge for Ubuntu (x64) to version 3.3.1.x or later • eMudhra emBridge for Red Hat (x64) to version 3.3.1.x or laterCNA solution statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-127 Directory Indexing (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 13 Nov 2026 Published

Weakness

• CWE-862

References

• www.cert-in.org.inthird-party-advisory
• emudhra.comvendor-advisory