CVE-2026-39847 — AI Deep Analysis Summary

🚨 **Essence**: Emmett (Python Web Framework) has a **Path Traversal** flaw in its RSGI static handler. 📉 **Consequences**: Attackers can read files **outside** the intended asset directory.…

🛡️ **CWE-22**: Improper Limitation of a Pathname to a Restricted Directory.…

📦 **Vendor**: emmett-framework. 🏷️ **Product**: emmett. 📅 **Affected Versions**: **2.5.0** up to **2.8.1** (exclusive). ⚠️ Any version in this range is vulnerable. 🚫 Versions < 2.5.0 or >= 2.8.1 are safe.

🕵️ **Privileges**: No authentication required (PR:N). 📂 **Data Access**: Can read **arbitrary files** on the server. 📄 **Impact**: High Confidentiality (C:H) - sensitive configs, keys, code exposed.…

🔓 **Threshold**: **LOW**. 🌐 **Network**: Attackable remotely (AV:N). 🚫 **Auth**: No privileges needed (PR:N). 👤 **User Interaction**: None required (UI:N). 🎯 **Complexity**: Low (AC:L).…

🚫 **Public Exploit**: **No**. The `pocs` field is empty. 📜 **Reference**: Official advisory available at GitHub GHSA-pr46-2v3c-5356.…

🔍 **Self-Check**: Scan for **Emmett** framework usage in Python apps. 📂 **Test**: Try accessing static files with `../` sequences. 🛠️ **Tooling**: Use DAST scanners targeting CWE-22.…

✅ **Fixed**: Yes. 📢 **Source**: Official GitHub Security Advisory (GHSA-pr46-2v3c-5356). 🔄 **Action**: Upgrade to **Emmett 2.8.2** or later. 🛡️ This resolves the RSGI static handler path traversal issue. 📦

🚧 **Workaround**: If patching is delayed, **disable** the RSGI static file handler if not needed. 🛑 **Restrict**: Ensure web server (Nginx/Apache) serves static files instead of the framework.…

🔥 **Priority**: **HIGH**. 🚨 **CVSS**: High severity (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H). ⏳ **Urgency**: Patch immediately. 📉 Risk of data breach is significant due to lack of auth requirement.…