Emmett is a full-stack Python web framework designed with simplicity. From 2.5.0 to before 2.8.1, the RSGI static handler for Emmett's internal assets (/__emmet…

CVE-2026-39847 affects the Emmett full-stack Python web framework versions 2.5.0 to before 2.8.1. The vulnerability exists in the RSGI static handler for Emmett's internal assets, specifically paths beginning with /__emmett__. Attackers can exploit this by using path traversal sequences like ../ to read arbitrary files outside the intended assets directory. An example attack vector is /__emmett__/../rsgi/handlers.py which allows unauthorized file access. This security flaw has been patched in version 2.8.1.