# CVE-2026-125659: Information Disclosure Vulnerability in eMudhra emBridge

Status: published. Published: 2026-11-13. Updated: 2026-11-13.

This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authorization. An unauthenticated attacker on the same LAN could exploit this vulnerability by sending malicious webpage to the local HTTPS Web API.

 

Successful exploitation of this vulnerability could allow the attacker to enumerate file and directory names and obtain information about the directory structure of the targeted system. 



The vulnerability however, does not provide access to file contents or permit file modification, deletion, or code execution, or access to cryptographic keys and hardware token PINs.

## Remediation

- fix: Upgrade eMudhra emBridge to latest versions:



•	eMudhra emBridge for Windows to version 5.9.4.x or later

•	eMudhra emBridge for macOS (x64) to version 3.2.7.x or later

•	eMudhra emBridge for Ubuntu (x64) to version 3.3.1.x or later

•	eMudhra  emBridge for Red Hat (x64) to version 3.3.1.x or later (source: CNA: CERT-In)

## Affected products and versions

- eMudhra / emBridge: version 5.9.1.x to 5.9.3.x (affected). Source: CNA: CERT-In; platforms: Windows
- eMudhra / emBridge: version 3.2.4.x to 3.2.6.x (affected). Source: CNA: CERT-In; platforms: MacOS
- eMudhra / emBridge: version 3.2.0.x to 3.3.0.x (affected). Source: CNA: CERT-In; platforms: Ubuntu
- eMudhra / emBridge: version 3.2.0.x to 3.3.0.x (affected). Source: CNA: CERT-In; platforms: Red Hat

## Severity and prioritization

- CVSS 4.0: 2.1 (low); CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N; source: CNA: CERT-In

- CVSS 4.0: 2.1 (low); CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: vdisclose@cert-in.org.in

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-862

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0549 (CNA: CERT-In; third-party-advisory)

- https://emudhra.com/en/post/cve-2026-125659 (CNA: CERT-In; vendor-advisory)

- https://emudhra.com/en/post/cve-2026-125659 (vdisclose@cert-in.org.in)

- https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0549 (vdisclose@cert-in.org.in)

## Provenance

- CNA: CERT-In: https://www.cve.org/CVERecord?id=CVE-2026-125659; retrieved 2026-11-13; source updated 2026-11-13

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-125659; retrieved 2026-11-13; source updated 2026-11-13

Revision: e1486e4589c56221f5359b7cd2752c673c51b1b38ff26d2428fe38006449b7f9

Canonical: https://y2.dev/cve/CVE-2026-125659

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.