CVE-2026-33054

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33054", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T18:10:50.212Z", "datePublished": "2026-03-20T06:57:35.948Z", "dateUpdated": "2026-03-20T13:50:27.328Z"}, "containers": {"cna": {"title": "Mesop: Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c"}, {"name": "https://github.com/mesop-dev/mesop/commit/c6b382f363b73ac32c402a2db3aadc7784f66a5b", "tags": ["x_refsource_MISC"], "url": "https://github.com/mesop-dev/mesop/commit/c6b382f363b73ac32c402a2db3aadc7784f66a5b"}, {"name": "https://github.com/mesop-dev/mesop/releases/tag/v1.2.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/mesop-dev/mesop/releases/tag/v1.2.3"}], "affected": [{"vendor": "mesop-dev", "product": "mesop", "versions": [{"version": "< 1.2.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T06:57:35.948Z"}, "descriptions": [{"lang": "en", "value": "Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows any user supplying an untrusted state_token through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service (via crash loops when reading non-msgpack target files as configurations), or arbitrary file manipulation. This vulnerability heavily exposes systems hosted utilizing FileStateSessionBackend. Unauthorized malicious actors could interact with arbitrary payloads overwriting or explicitly removing underlying service resources natively outside the application bounds. This issue has been fixed in version 1.2.3."}], "source": {"advisory": "GHSA-8qvf-mr4w-9x2c", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-20T13:50:11.848501Z", "id": "CVE-2026-33054", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T13:50:27.328Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33054", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-20T13:50:11.848501Z"}}}], "references": [{"url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T13:50:22.516Z"}}], "cna": {"title": "Mesop: Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion", "source": {"advisory": "GHSA-8qvf-mr4w-9x2c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "mesop-dev", "product": "mesop", "versions": [{"status": "affected", "version": "< 1.2.3"}]}], "references": [{"url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c", "name": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mesop-dev/mesop/commit/c6b382f363b73ac32c402a2db3aadc7784f66a5b", "name": "https://github.com/mesop-dev/mesop/commit/c6b382f363b73ac32c402a2db3aadc7784f66a5b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mesop-dev/mesop/releases/tag/v1.2.3", "name": "https://github.com/mesop-dev/mesop/releases/tag/v1.2.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows any user supplying an untrusted state_token through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service (via crash loops when reading non-msgpack target files as configurations), or arbitrary file manipulation. This vulnerability heavily exposes systems hosted utilizing FileStateSessionBackend. Unauthorized malicious actors could interact with arbitrary payloads overwriting or explicitly removing underlying service resources natively outside the application bounds. This issue has been fixed in version 1.2.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T06:57:35.948Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33054", "state": "PUBLISHED", "dateUpdated": "2026-03-20T13:50:27.328Z", "dateReserved": "2026-03-17T18:10:50.212Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T06:57:35.948Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mesop", "vendor": "mesop-dev", "versions": [{"status": "affected", "version": "< 1.2.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mesop-dev:mesop:*:*:*:*:*:*:*:*", "matchCriteriaId": "D66D038F-24FF-444E-B60F-6EAC62CDBB08", "versionEndExcluding": "1.2.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows any user supplying an untrusted state_token through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service (via crash loops when reading non-msgpack target files as configurations), or arbitrary file manipulation. This vulnerability heavily exposes systems hosted utilizing FileStateSessionBackend. Unauthorized malicious actors could interact with arbitrary payloads overwriting or explicitly removing underlying service resources natively outside the application bounds. This issue has been fixed in version 1.2.3."}, {"lang": "es", "value": "Mesop es un framework de interfaz de usuario basado en Python que permite a los usuarios construir aplicaciones web. Las versiones 1.2.2 e inferiores contienen una vulnerabilidad de salto de ruta que permite a cualquier usuario que suministre un state_token no confiable a trav\u00e9s de la carga \u00fatil del flujo de la interfaz de usuario dirigirse arbitrariamente a archivos en el disco bajo el backend de tiempo de ejecuci\u00f3n est\u00e1ndar basado en archivos. Esto puede resultar en denegaci\u00f3n de servicio de la aplicaci\u00f3n (a trav\u00e9s de bucles de bloqueo al leer archivos de destino que no son msgpack como configuraciones), o manipulaci\u00f3n arbitraria de archivos. Esta vulnerabilidad expone gravemente los sistemas alojados que utilizan FileStateSessionBackend. Actores maliciosos no autorizados podr\u00edan interactuar con cargas \u00fatiles arbitrarias sobrescribiendo o eliminando expl\u00edcitamente recursos de servicio subyacentes de forma nativa fuera de los l\u00edmites de la aplicaci\u00f3n. Este problema ha sido solucionado en la versi\u00f3n 1.2.3."}], "id": "CVE-2026-33054", "lastModified": "2026-06-17T10:36:52.323", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33054", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-20T13:50:11.848501Z", "version": "2.0.3"}}]}, "published": "2026-03-20T07:16:13.363", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mesop-dev/mesop/commit/c6b382f363b73ac32c402a2db3aadc7784f66a5b"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/mesop-dev/mesop/releases/tag/v1.2.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mesop", "source": "cna", "vendor": "mesop-dev"}, "product": "mesop", "vendor": "mesop-dev"}], "analysis": {"en": {"generated_at": "2026-03-24T17:29:40.122903+00:00", "value": {"mitigation_remediation": ["Upgrade Mesop to version 1.2.3 or later.", "If possible, switch to a safer session backend that does not perform path traversal on untrusted tokens.", "Monitor application logs for abnormal crashes or file modification activity to detect any remaining exploitation attempts."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary File Write/Deletion"}, "threat_synthesis": {"affected_systems": "The affected product is Mesop developed by mesop\u2011dev. Versions 1.2.2 and older are vulnerable. The issue is fixed in release 1.2.3. Systems that rely on FileStateSessionBackend for session state and are hosting the application are at risk.", "description_and_impact": "Mesop, a Python\u2011based UI framework, is affected by a path traversal flaw in versions 1.2.2 and earlier. An attacker can supply an untrusted state_token through the UI stream payload, causing the FileStateSessionBackend to resolve arbitrary file paths on the host file system. This can result in application denial of service, as the server may crash when attempting to read non\u2011msgpack configuration files, or enable the attacker to write or delete files outside the application\u2019s intended directory hierarchy.", "risk_and_exploitability": "The CVSS score of 10 indicates that this is a critical vulnerability. The EPSS score of less than 1 percent suggests that exploitation incidents are currently rare, and the vulnerability is not listed in the CISA KEV catalog, so no known large\u2011scale attacks have been reported. Nonetheless, the flaw is reachable via the publicly exposed UI stream, so it can be exploited remotely by an attacker without needing privileged access. Attackers would need to craft a malicious state_token and deliver it through the UI; upon processing, the backend will resolve and potentially overwrite or delete arbitrary files on the host, which can compromise system integrity or lead to denial of service."}}}}, "created": "2026-03-20T08:52:16.796017+00:00", "updated": "2026-03-25T14:30:13.947202+00:00", "vendors": ["mesop-dev", "mesop-dev$PRODUCT$mesop"]}