CVE-2026-39847Disclosure(emmett / emmett)

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch emmett emmett systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Emmett is a full-stack Python web framework designed with simplicity. From 2.5.0 to before 2.8.1, the RSGI static handler for Emmett's internal assets (/__emmett__ paths) is vulnerable to path traversal attacks. An attacker can use ../ sequences (eg /__emmett__/../rsgi/handlers.py) to read arbitrary files outside the assets directory. This vulnerability is fixed in 2.8.1.

emmett CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/emmett-framework/emmett/security/advisories/GHSA-pr46-2v3c-5356

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

emmett

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
6 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 6 signals
Disclosure: 4 classified signals
Peaked 1d ago at 3 mentions (2026-04-08); latest day: 1
6 total mentions across 3 days

Affected systems

Vendors

emmett

Products

emmett

Deep dive

Activity timeline6 mentions / 3d

Signal classification2 categories

Disclosure

466.7%

Patch

233.3%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-07	2	Disclosure1Patch1
2026-04-08	3	Disclosure2Patch1
2026-04-09	1	Disclosure1

Full discourse6 posts

PulsePatch.io@pulsepatchio183d
Disclosure
A critical path traversal vulnerability (CVE-2026-39847) affects the `Emmett` internal assets handler. This flaw could lead to unauthorized information disclosure from internal systems. #PathTraversal #AppSec #CVE https://www.pulsepatch.io/posts/cve-2026-39847-emmett-path-traversal
Post summary
The post announces CVE‑2026‑39847, a critical path traversal flaw in Emmett’s internal assets handler that can expose internal data, but it does not provide PoC, exploit, or patch details.
0000052
11 followersView on X
Vulert@vulert_official183d
Patch
🚨 Critical Emmett flaw: CVE-2026-39847 A path traversal issue could allow unauthorized access to sensitive files. Update to v2.8.1+ immediately. 🔗 https://vulert.com/vuln-db/CVE-2026-39847 #CyberSecurity #Emmett #CVE202639847 #Vulert https://t.co/WOoXTja4cE
Post summary
The tweet announces a path traversal vulnerability in Emmett (CVE‑2026‑39847) and urges users to update to version 2.8.1+ as a workaround.
0000037
124 followersView on X
CVE@CVEnew184d
Disclosure
CVE-2026-39847 Emmett is a full-stack Python web framework designed with simplicity. From 2.5.0 to before 2.8.1, the RSGI static handler for Emmett's internal assets (/__emmett__ pa… https://www.cve.org/CVERecord?id=CVE-2026-39847
Post summary
The post announces CVE‑2026‑39847 affecting Emmett framework 2.5.0 to before 2.8.1, noting the vulnerable static handler endpoint, but provides no PoC, exploit, or patch information.
00000136
57.0K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds184d
Disclosure
CVE-2026-39847 Path Traversal in Emmett Web Framework Versions 2.5.0 to 2.8.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39847
Post summary
A Path Traversal vulnerability (CVE-2026-39847) affecting Emmett Web Framework versions 2.5.0 through 2.8.0 is disclosed, with no evidence of proofs of concept, exploitation, or patches provided.
0000036
4.0K followersView on X
CVEFind.com@CveFindCom184d
Patch
[CVE-2026-39847: CRITICAL] Emmett Python web framework versions 2.5.0 to 2.8.0 are vulnerable to path traversal attacks. Upgrade to version 2.8.1 to fix this security flaw. #cybersecurity#cve,CVE-2026-39847,#cybersecurity https://cvefind.com/CVE-2026-39847
Post summary
CVE-2026-39847 exposes a critical path traversal flaw in Emmett Python versions 2.5.0‑2.8.0, and upgrading to 2.8.1 resolves the issue.
0000038
619 followersView on X
0day Signal@0dayPublishing184d
Disclosure
🚨 CVE-2026-39847: Emmett has a path traversal in i... Classic path traversal in Python web framework's static handler - CVSS 9.1 means arbitrary file read via `/__emmett__/.... https://zerodaysignal.com/vulnerability/CVE-2026-39847 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces a path traversal vulnerability (CVE-2026-39847) in the Emmett Python web framework, providing a CVSS score of 9.1 and a link to more details.
0000049
204 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	emmett	emmett	-	-	-

Explore more

Back to dashboard emmett CVEs emmett vulnerabilities

What researchers are saying

CVE-2026-39847

PulsePatch.io@pulsepatchioDisclosure

The post announces CVE‑2026‑39847, a critical path traversal flaw in Emmett’s internal assets handler that can expose internal data, but it does not provide PoC, exploit, or patch details.

Vulert@vulert_officialPatch

The tweet announces a path traversal vulnerability in Emmett (CVE‑2026‑39847) and urges users to update to version 2.8.1+ as a workaround.

CVE@CVEnewDisclosure

The post announces CVE‑2026‑39847 affecting Emmett framework 2.5.0 to before 2.8.1, noting the vulnerable static handler endpoint, but provides no PoC, exploit, or patch information.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A Path Traversal vulnerability (CVE-2026-39847) affecting Emmett Web Framework versions 2.5.0 through 2.8.0 is disclosed, with no evidence of proofs of concept, exploitation, or patches provided.

CVEFind.com@CveFindComPatch

CVE-2026-39847 exposes a critical path traversal flaw in Emmett Python versions 2.5.0‑2.8.0, and upgrading to 2.8.1 resolves the issue.

0day Signal@0dayPublishingDisclosure

The tweet announces a path traversal vulnerability (CVE-2026-39847) in the Emmett Python web framework, providing a CVSS score of 9.1 and a link to more details.