CVE-2026-33054: Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion

March 18, 2026 (updated March 20, 2026)

A Path Traversal vulnerability allows any user (or attacker) supplying an untrusted state_token through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service (via crash loops when reading non-msgpack target files as configurations), or arbitrary file manipulation.

References

github.com/advisories/GHSA-8qvf-mr4w-9x2c
github.com/mesop-dev/mesop
github.com/mesop-dev/mesop/commit/c6b382f363b73ac32c402a2db3aadc7784f66a5b
github.com/mesop-dev/mesop/releases/tag/v1.2.3
github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c
nvd.nist.gov/vuln/detail/CVE-2026-33054

Code Behaviors & Features

Detect and mitigate CVE-2026-33054 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →