9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-39847

CVE-2026-39847: Emmett has a path traversal in internal assets handler

Emmett is a full-stack Python web framework designed with simplicity. From 2.5.0 to before 2.8.1, the RSGI static handler for Emmett's internal assets (/emmett paths) is vulnerable to path traversal attacks. An attacker can use ../ sequences (eg /emmett/../rsgi/handlers.py) to read arbitrary files outside the assets directory. This vulnerability is fixed in 2.8.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-39847

CVE-2026-39847:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
emmett	pip	>= 2.5.0, < 2.8.1	2.8.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-pr46-2v3c-5356, is a path traversal issue in the Emmett framework's RSGI static asset handler. By analyzing the commits between the last vulnerable version (2.8.0) and the first patched version (2.8.1), the specific fixing commit 1c0cc24b668606f956d2eeae04b2ed0271998828 was identified. The patch modifies the _static_handler method within the HTTPHandler class in emmett/rsgi/handlers.py. The vulnerable code used os.path.join to concatenate a user-controlled path segment (file_name) without proper sanitization. The fix introduces os.path.realpath to resolve the canonical path and then validates that the resulting path is within the expected base directory for assets. This confirms that HTTPHandler._static_handler is the function responsible for handling the vulnerable file path construction and is the exact location of the vulnerability.

Vulnerable functions

HTTPHandler._static_handler

emmett/rsgi/handlers.py

The function constructs a file path for internal assets using `os.path.join` with a path component derived from the user's request. It fails to sanitize this path, allowing path traversal sequences like `../`. An attacker can exploit this to read arbitrary files from the server's filesystem outside of the intended assets directory.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.