GHSA-pr46-2v3c-5356HighCVSS 7.5

Emmett has a path traversal in internal assets handler

Published
April 8, 2026
Last Modified
June 6, 2026

🔗 CVE IDs covered (1)

📋 Description

The RSGI static handler for Emmett's internal assets (/__emmett__ paths) is vulnerable to path traversal attacks.

An attacker can use ../ sequences (eg /__emmett__/../rsgi/handlers.py) to read arbitrary files outside the assets directory.

🎯 Affected products1

  • pip/emmett:>= 2.5.0, < 2.8.1

🔗 References (4)