Executive brief
Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion
Affected products
- PyPI mesop
Junglewise Threat Intelligence
CVE-2026-33054: PYSEC-2026-411 - Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion
CVE-2026-33054 · Severity: low · CVSS 3.1 · Published 2026-06-29
Technologies: mesop (PyPI). Vendors: PyPI.
Related threats
- Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint pass
- PYSEC-2026-1624 - Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks
- PYSEC-2026-1625 - Mesop has a local file Inclusion via static file serving functionality
- PYSEC-2026-412 - Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py
- mesop-dev Mesop uncontrolled resource consumption in WebSocket handler