Emmett
Monthly
Path traversal in Emmett Python web framework versions 2.5.0 through 2.8.0 allows remote unauthenticated attackers to read arbitrary server files via crafted requests to the /__emmett__ static asset handler. Attackers can exfiltrate sensitive data including source code, configuration files, and credentials by exploiting improper path validation in the RSGI static handler. EPSS score of 0.05% (16th percentile) indicates low observed exploitation likelihood despite critical CVSS 9.1 rating. No public exploit code or CISA KEV listing identified at time of analysis.
Path traversal in Emmett Python web framework versions 2.5.0 through 2.8.0 allows remote unauthenticated attackers to read arbitrary server files via crafted requests to the /__emmett__ static asset handler. Attackers can exfiltrate sensitive data including source code, configuration files, and credentials by exploiting improper path validation in the RSGI static handler. EPSS score of 0.05% (16th percentile) indicates low observed exploitation likelihood despite critical CVSS 9.1 rating. No public exploit code or CISA KEV listing identified at time of analysis.