CVE-2026-39847
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Emmett, a full-stack Python web framework, versions 2.5.0 through 2.8.0 contain a path traversal vulnerability in the RSGI static handler for internal assets (/__emmett__ paths). An attacker can use ../ sequences (e.g., /__emmett__/../rsgi/handlers.py) to read arbitrary files outside the assets directory.
Risk Assessment
This vulnerability allows reading sensitive system files or application source code, potentially leading to data disclosure or further attacks.
Recommendation
Upgrade Emmett to version 2.8.1, which includes a fix for the path traversal vulnerability.
Original NVD description (English source)
Emmett is a full-stack Python web framework designed with simplicity. From 2.5.0 to before 2.8.1, the RSGI static handler for Emmett's internal assets (/__emmett__ paths) is vulnerable to path traversal attacks. An attacker can use ../ sequences (eg /__emmett__/../rsgi/handlers.py) to read arbitrary files outside the assets directory. This vulnerability is fixed in 2.8.1.