CVE-2026-33054: Mesop Path Traversal Vulnerability Leading to Denial of Service and File Manipulation
Summary
CVE-2026-33054: A Path Traversal vulnerability allows any user (or attacker) supplying an untrusted state_token through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. Affects mesop versions < 1.2.3. Fixed in 1.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mesop is an open-source framework designed for managing stateful applications, utilizing a file-based runtime backend for session management. It allows developers to maintain session states efficiently. However, its reliance on user-supplied tokens for file paths has exposed it to critical vulnerabilities, particularly a Path Traversal issue that can lead to unauthorized file access and manipulation.
Vulnerability Detail
The vulnerability arises from the use of untrusted user input in the state_token parameter, which is directly passed to the FileStateSessionBackend for file path generation. This allows attackers to exploit path traversal techniques, enabling them to access sensitive files on the server, potentially leading to application crashes or unauthorized file modifications. The vulnerability is particularly severe as it can result in Denial of Service (DoS) attacks and unauthorized access to critical system files.
How To Fix
Latest published version: 1.3.7 as of 23 Oct 2026
pip install --upgrade "mesop==1.3.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.3
This is the first release that contains the fix.
pip install --upgrade "mesop==1.2.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the FileStateSessionBackend for session management. Instead, consider using an alternative session backend that does not rely on file paths derived from user input. Additionally, validate and sanitize any user input that is used to construct file paths.
Conclusion
The Path Traversal vulnerability in Mesop (CVE-2026-33054) poses a significant risk to applications using the FileStateSessionBackend. It is crucial to update to the patched version or implement workarounds to mitigate potential attacks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for mesop →
FAQ
A Path Traversal vulnerability allows attackers to access files and directories that are stored outside the intended directory structure, potentially leading to unauthorized file access.
If exploited, this vulnerability can lead to Denial of Service attacks, unauthorized file manipulation, and exposure of sensitive information stored on the server.
The CVSS score of this vulnerability is 10.0, indicating a critical level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without needing to sign up.
If you cannot update the package, implement the suggested workarounds, such as avoiding the use of the vulnerable session backend and sanitizing user inputs.
References
Related vulnerabilities
Recent vulnerabilities recorded for mesop.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
