CVE-2026-103263: Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tornadoto a version that resolves this vulnerability.Fixed in 6.5.9
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Tornado StaticFileHandler before 6.5.9 are exposed if their configured static root contains a symbolic link whose target is outside that root. The impact is limited to files that the Tornado process user can read.
What does an attacker need to exploit it?
An attacker needs only network access to make requests to the affected StaticFileHandler; no authentication or user interaction is required. Exploitation also depends on an out-of-root symlink being present within the static directory.
Is a default static-file deployment necessarily affected?
No. The described condition requires a symbolic link inside the static root that points outside it. A static directory without such symlinks is not described as exploitable by this issue.
What can be done if upgrading is not immediately possible?
Remove or replace symbolic links within the static root that resolve outside that directory, and ensure the static-file process user cannot read sensitive files unnecessarily. Review the static root for existing symlinks and their resolved targets.
How can I determine whether my application is already exposed?
Check whether the application uses StaticFileHandler and whether its Tornado version is earlier than 6.5.9. Then inspect the configured static root for symbolic links that resolve to locations outside the root, especially links to configuration, key, or secret files.