---
id: CVE-2026-103263
title: >-
  Tornado before 6.5.9 contains a path traversal vulnerability in
  StaticFileHandler that follows symbolic links inside the static root without
  confirming the resolved target stays within it
summary: >-
  Tornado before 6.5.9 contains a path traversal vulnerability in
  StaticFileHandler that follows symbolic links inside the static root without
  confirming the resolved target stays within it. When a symlink pointing
  outside the static direc…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-59
vendor: tornadoweb
product: tornado
affected:
  - tornado < 6.5.9
published: '2026-10-01'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T20:17:23.097'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103263'
references:
  - url: >-
      https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/tornado-before-6.5.9-staticfilehandler-path-traversal-via-symlink
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/tornadoweb/tornado/pull/3719'
  - url: >-
      https://github.com/tornadoweb/tornado/commit/f9f50b8bab265a2abf9f2415a3d2da6264a5450b
  - url: 'https://github.com/tornadoweb/tornado'
  - url: 'https://github.com/tornadoweb/tornado/releases/tag/v6.5.9'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103263.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-103263'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2544519'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-103263'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103263'
tags:
  - nvd
  - cve.org
  - exploit-available
  - osv
  - pip
  - csaf
  - vex
  - red-hat
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-01T19:29:31.769581Z'
ingestedAt: '2026-10-01T11:42:53.805Z'
aliases:
  - GHSA-c2m8-h5v5-343r
ecosystem: pip
patched:
  - tornado 6.5.9
epss: 0.00522
epssPercentile: 0.44132
---

## Overview

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-103263)

Affected packages:

- `tornado < 6.5.9`

Patched in:

- `tornado 6.5.9`

Source: https://osv.dev/vulnerability/GHSA-c2m8-h5v5-343r

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, … · no fix planned: Migration Toolkit for Applications 8, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Lightspeed Core, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103263.json)