CVE-2026-103263

NameCVE-2026-103263
DescriptionTornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1149712

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-tornado (PTS)bookworm, bookworm (security)6.2.0-3+deb12u4vulnerable
trixie (security), trixie6.4.2-3+deb13u2vulnerable
forky, sid6.5.5-5vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-tornadosource(unstable)(unfixed)1149712

Notes

https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
Fixed by: https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32 (v6.5.9)
Search for package or bug name: Reporting problems