CVE-2026-39847: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in emmett-framework emmett
A critical path traversal vulnerability (CWE-22) exists in the Emmett Python web framework versions 2. 5. 0 up to but not including 2. 8. 1. The vulnerability affects the RSGI static handler serving internal assets under the /__emmett__ path, allowing an attacker to use .. / sequences to access arbitrary files outside the intended assets directory. This can lead to unauthorized disclosure of sensitive files. The issue is fixed starting from version 2. 8.
AI Analysis
Technical Summary
Emmett framework versions 2.5.0 to before 2.8.1 contain a path traversal vulnerability in the RSGI static handler for internal assets. The handler does not properly restrict pathname inputs, allowing attackers to craft requests with ../ sequences (e.g., /__emmett__/../rsgi/handlers.py) to read files outside the designated assets directory. This vulnerability is identified as CWE-22 and has a CVSS v3.1 score of 9.1, reflecting critical severity due to its ease of exploitation and potential to disclose sensitive information. The vulnerability is resolved in Emmett version 2.8.1.
Potential Impact
Successful exploitation allows unauthenticated remote attackers to read arbitrary files on the server outside the intended assets directory. This can lead to disclosure of sensitive information and potentially disrupt availability. The CVSS vector indicates no privileges or user interaction are required, making the attack highly feasible over the network. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade Emmett to version 2.8.1 or later, where this path traversal vulnerability is fixed. Since no official patch links or vendor advisories are provided, users should verify the version upgrade to ensure remediation. Patch status is not explicitly confirmed beyond the version fix note, so check the vendor's official release notes for confirmation.
CVE-2026-39847: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in emmett-framework emmett
Description
A critical path traversal vulnerability (CWE-22) exists in the Emmett Python web framework versions 2. 5. 0 up to but not including 2. 8. 1. The vulnerability affects the RSGI static handler serving internal assets under the /__emmett__ path, allowing an attacker to use .. / sequences to access arbitrary files outside the intended assets directory. This can lead to unauthorized disclosure of sensitive files. The issue is fixed starting from version 2. 8.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Emmett framework versions 2.5.0 to before 2.8.1 contain a path traversal vulnerability in the RSGI static handler for internal assets. The handler does not properly restrict pathname inputs, allowing attackers to craft requests with ../ sequences (e.g., /__emmett__/../rsgi/handlers.py) to read files outside the designated assets directory. This vulnerability is identified as CWE-22 and has a CVSS v3.1 score of 9.1, reflecting critical severity due to its ease of exploitation and potential to disclose sensitive information. The vulnerability is resolved in Emmett version 2.8.1.
Potential Impact
Successful exploitation allows unauthenticated remote attackers to read arbitrary files on the server outside the intended assets directory. This can lead to disclosure of sensitive information and potentially disrupt availability. The CVSS vector indicates no privileges or user interaction are required, making the attack highly feasible over the network. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade Emmett to version 2.8.1 or later, where this path traversal vulnerability is fixed. Since no official patch links or vendor advisories are provided, users should verify the version upgrade to ensure remediation. Patch status is not explicitly confirmed beyond the version fix note, so check the vendor's official release notes for confirmation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-07T19:13:20.378Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d57b23aaed68159a6dfc1e
Added to database: 4/7/2026, 9:46:11 PM
Last enriched: 4/15/2026, 3:54:58 PM
Last updated: 5/22/2026, 6:16:48 PM
Views: 104
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.