CVE-2024-45601: Mesop Local File Inclusion Vulnerability
Summary
CVE-2024-45601: Mesop has a local file Inclusion via static file serving functionality. Affects mesop versions >= 0.9.0, < 0.12.4. Fixed in 0.12.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mesop is an open-source application available on PyPI that serves static files and provides various functionalities for web applications. It is designed to facilitate easy file serving and management. However, due to insufficient input validation in one of its endpoints, Mesop has become vulnerable to local file inclusion attacks, potentially allowing unauthorized access to sensitive files on the server.
Vulnerability Detail
A vulnerability has been identified in Mesop that allows for local file inclusion through its static file serving functionality. This issue arises from inadequate input validation, which could enable attackers to access files that should not be publicly accessible. The ramifications of this vulnerability include unauthorized access to sensitive data, which could lead to data breaches or further exploitation of the server. It is crucial for users to understand that this vulnerability can be exploited without prior authentication, making it particularly dangerous.
How To Fix
Latest published version: 1.3.7 as of 23 Oct 2026
pip install --upgrade "mesop==1.3.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.4
This is the first release that contains the fix.
pip install --upgrade "mesop==0.12.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to sensitive files by modifying server configurations to prevent unauthorized access. Additionally, ensure that input validation is implemented in the application to sanitize user inputs before processing them.
Conclusion
In summary, the local file inclusion vulnerability in Mesop poses a significant risk to users, allowing unauthorized access to sensitive files. It is essential to update to the latest version to mitigate this risk. Users should also consider implementing additional security measures as a precaution.
See every vulnerability recorded for mesop →
FAQ
The vulnerability is a local file inclusion issue that arises from insufficient input validation, allowing unauthorized access to server files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high level of severity.
If an immediate update is not possible, implement input validation and restrict access to sensitive files as a temporary workaround.
The vulnerability was reported by a user identified as @Letm3through, who also proposed mitigations to address the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for mesop.
