Path Traversal Vulnerability in Mesop UI Framework by Mesop

CVE-2026-33054

What is CVE-2026-33054?

The Mesop UI framework has a Path Traversal vulnerability affecting versions 1.2.2 and earlier. This flaw enables an attacker to exploit an untrusted state_token within the UI stream payload, potentially targeting sensitive files on disk through the FileStateSessionBackend. Exploitation may lead to denial of service or arbitrary file alterations, where malicious users can overwrite or eradicate essential service resources beyond application boundaries. To mitigate this risk, users are advised to upgrade to version 1.2.3, in which this issue has been addressed.

References