CVE-2026-33054 Details
Description
Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows any user supplying an untrusted state_token through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service (via crash loops when reading non-msgpack target files as configurations), or arbitrary file manipulation. This vulnerability heavily exposes systems hosted utilizing FileStateSessionBackend. Unauthorized malicious actors could interact with arbitrary payloads overwriting or explicitly removing underlying service resources natively outside the application bounds. This issue has been fixed in version 1.2.3.
A path traversal vulnerability has been identified in Mesop versions 1.2.2 and prior. This vulnerability allows users to manipulate the 'state_token' in the UI stream payload, targeting arbitrary files on the disk when the application is using the 'FileStateSessionBackend' for session management. Exploitation of this vulnerability can lead to application denial-of-service, caused by crash loops from reading non-msgpack files as configurations, or allow unauthorized file manipulation. The issue arises because the 'state_token' is taken from an untrusted source and passed directly to the file backend, where standard path traversal techniques can be used to escape the intended directory and access sensitive files.
Users can upgrade to Mesop version 1.2.3, which addresses the path traversal vulnerability by adding proper validation to the 'state_token' before it is processed by the 'FileStateSessionBackend'.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c | CISA-ADP | ExploitVendor Advisory |
| https://github.com/mesop-dev/mesop/commit/c6b382f363b73ac32c402a2db3aadc7784f66a5b | [email protected] | Patch |
| https://github.com/mesop-dev/mesop/releases/tag/v1.2.3 | [email protected] | Release Notes |
| https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mesop-dev mesop | < 1.2.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | New CVE Received | [email protected] |