DEBIAN-CVE-2026-123534: Path Traversal

Published Nov 8, 2026

Updated

Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.staticurl() and getversion() that allows attackers to hash files outside staticpath using ../ sequences. Attackers controlling input passed to staticurl() can obtain SHA-512 hashes of readable files to confirm their existence, or reference /dev/zero to block the event loop indefinitely.

Affected Software

3 affected components

debian/python-tornado*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Tornado to a version that resolves this vulnerability.
Fixed in 6.6

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to control input that the application passes to Tornado's static_url() function. The issue is exploitable remotely without authentication or user interaction, but requires a viable traversal payload using ../ sequences.

What can an attacker do with this issue?

An attacker can cause Tornado to compute SHA-512 hashes of readable files outside the configured static_path, which can be used to confirm that files exist. Referencing /dev/zero can also cause the event loop to block indefinitely, resulting in a denial of service.

Which deployments are affected?

Deployments using Tornado versions before 6.6 are affected when untrusted input can reach static_url(). The provided data does not establish that a default application configuration exposes attacker-controlled input to this function.

DEBIAN-CVE-2026-123534: Path Traversal

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

What can an attacker do with this issue?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What can an attacker do with this issue?

Which deployments are affected?