{"id":"CVE-2026-103263","title":"Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it","summary":"Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static direc…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-59"],"vendor":"tornadoweb","product":"tornado","affected":["tornado < 6.5.9"],"published":"2026-10-01","updated":"2026-10-01","sourceUpdated":"2026-10-01T20:17:23.097","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103263","references":[{"url":"https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32","label":"disclosure@vulncheck.com"},{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/tornado-before-6.5.9-staticfilehandler-path-traversal-via-symlink","label":"disclosure@vulncheck.com"},{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/tornadoweb/tornado/pull/3719"},{"url":"https://github.com/tornadoweb/tornado/commit/f9f50b8bab265a2abf9f2415a3d2da6264a5450b"},{"url":"https://github.com/tornadoweb/tornado"},{"url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103263.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-103263"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544519"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-103263"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103263"}],"tags":["nvd","cve.org","exploit-available","osv","pip","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-01T19:29:31.769581Z"},"ingestedAt":"2026-10-01T11:42:53.805Z","aliases":["GHSA-c2m8-h5v5-343r"],"ecosystem":"pip","patched":["tornado 6.5.9"],"epss":0.00522,"epssPercentile":0.44132,"slug":"CVE-2026-103263","body":"## Overview\n\nTornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-103263)\n\nAffected packages:\n\n- `tornado < 6.5.9`\n\nPatched in:\n\n- `tornado 6.5.9`\n\nSource: https://osv.dev/vulnerability/GHSA-c2m8-h5v5-343r\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, … · no fix planned: Migration Toolkit for Applications 8, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Lightspeed Core, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103263.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":214667,"id":"CVE-2026-103263","ts":1790884802487,"field":"exploit_available","old":"false","new":"true"}]}