CVE-2026-39847
A security flaw in the Emmett Python web framework allows attackers to access files they shouldn't be able to see. By using specific character sequences, an attacker can navigate outside the intended folder to read sensitive files on the server.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users of the Emmett Python web framework, specifically versions 2.5.0 through versions prior to 2.8.1.
Real-world impact
An attacker could read arbitrary files from the server, potentially exposing sensitive configuration files, source code, or other private data stored on the system.
Why this severity
This vulnerability is rated critical because it can be exploited remotely over the network without requiring any user interaction or special privileges, and it allows for the theft of highly sensitive information.
What to do about it
- 01Upgrade Emmett to version 2.8.1 or later.
NVD-referenced vendor advisory
Timeline
- Apr 7, 2026 · Apr 7, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/emmett-framework/emmett/sec…vendor advisory