GitHub Advisoryadvisory · PyPI
GHSA-pr46-2v3c-5356 Emmett has a path traversal in internal assets handler
HIGH
Official page ↗
- Aliases
- CVE-2026-39847
- Ecosystem
- PyPI
- Packages
- emmett
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-22
- Reviewed
- 2026-04-08
Affected packages
• PyPI emmett: >= 2.5.0, < 2.8.1 → fixed in 2.8.1
Description
The RSGI static handler for Emmett's internal assets (`/__emmett__` paths) is vulnerable to path traversal attacks.
An attacker can use `../` sequences (eg `/__emmett__/../rsgi/handlers.py`) to read arbitrary files outside the assets directory.
Related
Alias · CVE (1)
- CVE-2026-39847 Emmett is a full-stack Python web framework designed with simplicity. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness