What is the CVSS score of EUVD-2026-19974?

EUVD-2026-19974 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by EUVD-2026-19974?

A critical path traversal vulnerability in Emmett Python web framework versions 2.5.0-2.8.0 permits unauthenticated remote attackers to read arbitrary files from affected servers, potentially…. A patch is available.

How to fix or mitigate EUVD-2026-19974?

Within 24 hours: Identify all systems running Emmett 2.5.0-2.8.0 using inventory and dependency scanning tools. Within 7 days: Apply vendor-released patch to upgrade Emmett to version 2.8.1 or later on all affected instances; test in staging environment first. Within 30 days: Conduct audit of access logs for suspicious requests to /__emmett__ endpoint during the vulnerability window; review and rotate any credentials stored in configuration files or source code repositories.

Python EUVD-2026-19974

| CVE-2026-39847 CRITICAL

Path Traversal (CWE-22)

2026-04-07 GitHub_M

GHSA-pr46-2v3c-5356

Python Path Traversal

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 04:57 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 16, 2026 - 04:50 vuln.today

cvss_changed

Patch released

Apr 08, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 07, 2026 - 22:16 euvd

EUVD-2026-19974

Analysis Generated

Apr 07, 2026 - 22:16 vuln.today

CVE Published

Apr 07, 2026 - 21:37 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Emmett is a full-stack Python web framework designed with simplicity. From 2.5.0 to before 2.8.1, the RSGI static handler for Emmett's internal assets (/__emmett__ paths) is vulnerable to path traversal attacks. An attacker can use ../ sequences (eg /__emmett__/../rsgi/handlers.py) to read arbitrary files outside the assets directory. This vulnerability is fixed in 2.8.1.

AnalysisAI

Path traversal in Emmett Python web framework versions 2.5.0 through 2.8.0 allows remote unauthenticated attackers to read arbitrary server files via crafted requests to the /__emmett__ static asset handler. Attackers can exfiltrate sensitive data including source code, configuration files, and credentials by exploiting improper path validation in the RSGI static handler. EPSS score of 0.05% (16th percentile) indicates low observed exploitation likelihood despite critical CVSS 9.1 rating. No public exploit code or CISA KEV listing identified at time of analysis.

Technical ContextAI

Emmett is a full-stack Python web framework that serves internal framework assets through a dedicated RSGI (Rapid Server Gateway Interface) static file handler at the /__emmett__ path prefix. The vulnerability stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) where the static handler fails to properly sanitize user-controlled path input. Attackers can inject directory traversal sequences (../) to escape the intended assets directory and access arbitrary filesystem locations accessible to the web server process. The RSGI handler, responsible for serving framework resources like JavaScript, CSS, and Python modules, processes these malicious paths without adequate canonicalization or boundary validation, treating /__emmett__/../rsgi/handlers.py as a legitimate request rather than a directory escape attempt. This affects the cpe:2.3:a:emmett-framework:emmett product line specifically.

RemediationAI

Upgrade to Emmett version 2.8.1 or later, which contains vendor-released patch fixing the path traversal vulnerability in the RSGI static handler. The fix is available through standard Python package managers via pip install --upgrade emmett or by updating requirements.txt to specify emmett>=2.8.1. For environments unable to upgrade immediately, implement compensating controls by configuring a reverse proxy (nginx, Apache, Caddy) to block requests matching the pattern /__emmett__/.*\.\./ or to deny all access to /__emmett__/* paths if the application does not require Emmett's internal asset serving. This mitigation prevents external access to the vulnerable handler but may break framework functionality relying on those assets (debugging tools, admin interfaces). Alternatively, deploy Emmett behind a web application firewall with path traversal detection rules, though this provides defense-in-depth rather than eliminating the underlying vulnerability. The reverse proxy approach introduces configuration complexity and requires testing to ensure legitimate application routes remain accessible. Review application logs for requests to /__emmett__ paths containing ../ sequences as potential exploitation indicators. Consult the GitHub advisory at https://github.com/emmett-framework/emmett/security/advisories/GHSA-pr46-2v3c-5356 for additional vendor guidance.