Vulnerable code sample

import os
import msgpack
from typing import Any

# This code is a representation of the vulnerable `FileStateSessionBackend`
# class from Mesop version 1.2.2 (CVE-2026-33054). The original class
# inherits from a base class and uses specific types from the Mesop framework.
# These have been simplified here to focus on the core vulnerability.

# In the actual Mesop framework, this path is defined in `mesop.server.constants`.
SESSIONS_PATH = "mesop_sessions"

def get_session_id_from_request() -> str:
    """
    A placeholder function. In the real application, this function would
    retrieve the `state_token` from the incoming UI stream payload.
    This token is untrusted and can be controlled by an attacker.
    """
    # In a real exploit, the web framework would populate the context that this
    # function reads from. For example, an attacker could send a `state_token`
    # with the value "../../../../../etc/passwd".
    raise NotImplementedError(
        "In a real server, this would be implemented to get the untrusted state_token."
    )


class FileStateSessionBackend:
    """
    Vulnerable class demonstrating path traversal.
    This is based on mesop/backend/file_state_session_backend.py in v1.2.2.
    """
    def __init__(self):
        # In the real application, this would ensure the session directory exists.
        if not os.path.exists(SESSIONS_PATH):
            os.makedirs(SESSIONS_PATH)

    def _get_state_file_path(self, session_id: str) -> str:
        # THE VULNERABILITY:
        # The `session_id` (derived from the user-supplied `state_token`) is used
        # to construct a file path without any sanitization or validation.
        # `os.path.join` will resolve path traversal sequences like "../",
        # allowing an attacker to navigate outside of the intended `SESSIONS_PATH` directory.
        return os.path.join(SESSIONS_PATH, session_id + ".msgpack")

    def get_state(self, session_id: str) -> Any:
        """
        This method is used to load session state. An attacker can exploit
        it to read arbitrary files by supplying a malicious `session_id`.
        """
        state_file_path = self._get_state_file_path(session_id)

        if not os.path.exists(state_file_path):
            # In the real app, this returns a special `InitialState` object.
            return None

        # The application will attempt to open and read the file at the
        # attacker-controlled path.
        with open(state_file_path, "rb") as f:
            # If the targeted file (e.g., a system file like /etc/passwd) is not a valid
            # msgpack object, this line will raise an exception. This can lead to
            # an application crash and a denial-of-service.
            state = msgpack.unpackb(f.read(), raw=False)
            return state

    def save_state(self, state: Any) -> None:
        """
        This method is used to save session state. An attacker can exploit
        it to write to or overwrite arbitrary files.
        """
        # The session_id is retrieved from the request context, which is untrusted
        # because it comes from the `state_token` sent by the client.
        session_id = get_session_id_from_request()

        state_file_path = self._get_state_file_path(session_id)

        # The application will open the file at the attacker-controlled path in
        # write-binary mode. This allows an attacker to overwrite existing files
        # (e.g., source code, configuration) or create new ones in arbitrary
        # locations, limited only by the file permissions of the web server process.
        with open(state_file_path, "wb") as f:
            f.write(msgpack.packb(state))