CVE-2026-39847

OVERVIEW CVE-2026-39847 is a path traversal vulnerability affecting the Emmett Python web framework versions 2.5.0 through 2.8.0. The flaw exists in the RSGI static handler that serves Emmett's internal assets via the /__emmett__ path. Attackers can exploit directory traversal sequences (such as /../) to bypass path restrictions and read arbitrary files from the server outside the intended assets directory. The vulnerability has been remediated in version 2.8.1. SEVERITY This vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack has low complexity, making it relatively straightforward to execute. The primary impact is confidentiality compromise, allowing unauthorized disclosure of sensitive files such as source code, configuration files, and other system information. No integrity or availability impacts are present. EXPLOITATION STATUS Currently, there is no evidence of active exploitation in the wild, as the vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and maintains an inactive status on exploit tracking lists. The EPSS score of 0.0006 indicates minimal probability of exploitation in the next 30 days. However, organizations running affected Emmett versions should prioritize upgrading to 2.8.1 given the straightforward nature of the attack and the sensitivity of potentially exposed files.