CVE-2026-125659 · Other
NO FIX YET
The eMudhra emBridge local HTTPS API has FileBrowser endpoints that list file and directory names on the machine without checking who is asking. An attacker on the same LAN can use a malicious webpage to learn the directory structure, but cannot read file contents, modify files, or run code.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems where the eMudhra emBridge application is installed and its local HTTPS Web API is reachable from the network, which is the path a malicious webpage uses. Machines without emBridge installed are not exposed. The sources do not state the affected versions or a fixed release.
Not affected if embridge-not-installed
Who cares emudhra-embridge, windows
Unknown from the sources.
No fix yet, per the sources.
This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authorization. An unauthenticated attacker on the same LAN could exploit this vulnerability by sending malicious webpage to the local HTTPS Web API.
Successful exploitation of this vulnerability could allow the attacker to enumerate file and directory names and obtain information about the directory structure of the targeted system.
The vulnerability however, does not provide access to file contents or permit file modification, deletion, or code execution, or access to cryptographic keys and hardware token PINs.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.