Mesop hat eine Path Traversal-Schwachstelle, die über `FileStateSessionBackend` zu einem Application Denial of Service und File Write/Deletion führt.

The impact of this Path Traversal vulnerability is significant. An attacker who can control the state_token can bypass intended access controls and read or even modify files on the server's file system. This could lead to a denial of service by repeatedly requesting invalid files, causing the application to crash. More critically, an attacker could potentially overwrite configuration files or other sensitive data, leading to complete system compromise. The ability to manipulate files directly on disk represents a severe security risk, especially in environments where mesop is used to manage critical infrastructure or sensitive data.

Organizations deploying mesop with the FileStateSessionBackend are at significant risk, particularly those running versions prior to 1.2.3. Shared hosting environments where multiple users share the same file system are especially vulnerable, as an attacker could potentially compromise other users' sessions.

• python / server:

import os
import subprocess

def check_mesop_version():
    try:
        result = subprocess.check_output(['mesop', '--version'], stderr=subprocess.STDOUT, text=True)
        version = result.strip()
        if version.startswith('1.2.2rc'):
            print(f"VULNERABLE: mesop version {version} detected.")
        elif version.startswith('1.2.3'):
            print(f"PATCHED: mesop version {version} detected.")
        else:
            print(f"mesop version {version} detected.  Check for updates.")
    except FileNotFoundError:
        print("mesop not found.  Check installation.")

check_mesop_version()

1. 2026-03-18Disclosure

   disclosure

1. Reserviert2026-03-17
2. Veröffentlicht2026-03-18
3. Geändert2026-03-20
4. EPSS aktualisiert2026-03-27

The primary mitigation for CVE-2026-33054 is to upgrade mesop to version 1.2.3 or later, which contains the fix for this vulnerability. If immediate upgrading is not possible, consider implementing stricter input validation on the statetoken parameter to prevent malicious input. While not a complete solution, a Web Application Firewall (WAF) configured to block requests containing suspicious characters or patterns in the statetoken could provide an additional layer of defense. Monitor system logs for unusual file access patterns or attempts to read files outside of expected directories.