CVE-2026-33054 Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion
Attackers can exploit path traversal in Mesop's FileStateSessionBackend to overwrite or delete files, causing denial of service or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33054?
CVE-2026-33054 is a critical path traversal vulnerability in mesop-dev mesop, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows any user supplying an untrusted state_token through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service (via crash loops when reading non-msgpack target files as configurations), or arbitrary file manipulation. This vulnerability heavily exposes systems hosted utilizing FileStateSessionBackend. Unauthorized malicious actors could interact with arbitrary payloads overwriting or explicitly removing underlying service resources natively outside the application bounds. This issue has been fixed in version 1.2.3.
Weakness: CWE-22
Which versions are affected by CVE-2026-33054?
3 open source packages ship an affected version, including mesop. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mesop PyPI | All versions | 1.2.3 |
mesop PyPI | All versions | 1.2.3 |
mesop PyPI | All versions | 1.2.3 |
Products include Mesop-Dev Mesop.
How do I fix CVE-2026-33054?
Upgrade mesop to 1.2.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-33054 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33054 exists.
Other vulnerabilities in mesop-dev mesop
Sources
Also known as GHSA-8qvf-mr4w-9x2c, PYSEC-2026-411.