CVE-2026-39847 Emmett has a path traversal in internal assets handler
An attacker can read arbitrary files outside the assets directory via path traversal in the internal assets handler of the Emmett Python web framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39847?
CVE-2026-39847 is a critical path traversal vulnerability in emmett-framework emmett, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Emmett is a full-stack Python web framework designed with simplicity. From 2.5.0 to before 2.8.1, the RSGI static handler for Emmett's internal assets (/__emmett__ paths) is vulnerable to path traversal attacks. An attacker can use ../ sequences (eg /__emmett__/../rsgi/handlers.py) to read arbitrary files outside the assets directory. This vulnerability is fixed in 2.8.1.
Weakness: CWE-22
Which versions are affected by CVE-2026-39847?
3 open source packages ship an affected version, including emmett. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
emmett PyPI | From 2.5.0 | 2.8.1 |
emmett PyPI | From 2.5.0 | 2.8.1 |
emmett PyPI | From 2.5.0 | 2.8.1 |
Products include Emmett Emmett.
How do I fix CVE-2026-39847?
Upgrade emmett to 2.8.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-39847 being exploited?
There is no known exploitation of CVE-2026-39847 in the wild and no public exploit code.
Sources
Also known as GHSA-pr46-2v3c-5356, PYSEC-2026-59.