HIGH 8.2 NVD
CVE-2026-103263
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the reso
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
References
- https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
- https://www.vulncheck.com/advisories/tornado-before-6.5.9-staticfilehandler-path-traversal
This high severity vulnerability with a CVSS score of 8.2 was published on 2026-10-01 via NVD.
vulnfeed aggregates 12641 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.