GHSA-v8g8-cp5j-42fg: Tornado before 6.6 Path Traversal via static_url() Version Hashing

Published Nov 8, 2026

Updated

Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.staticurl() and getversion() that allows attackers to hash files outside staticpath using ../ sequences. Attackers controlling input passed to staticurl() can obtain SHA-512 hashes of readable files to confirm their existence, or reference /dev/zero to block the event loop indefinitely.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Tornado to a version that resolves this vulnerability.
Fixed in 6.6

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker control to exploit this issue?

The attacker must be able to control input that is passed to RequestHandler.static_url(). They can use ../ sequences to cause version hashing of readable files outside the configured static_path.

What is the practical impact beyond confirming file existence?

The issue can expose SHA-512 hashes of readable files outside static_path, which may allow an attacker to confirm that those files exist. Supplying /dev/zero can cause hashing to run indefinitely and block the event loop.

Are only applications using static file versioning exposed?

The vulnerable behavior is in static_url() and get_version(). Exposure depends on whether attacker-controlled input can reach static_url(); the provided data does not establish that this is reachable in a default application configuration.

GHSA-v8g8-cp5j-42fg: Tornado before 6.6 Path Traversal via static_url() Version Hashing

Remediation

Event History

Frequently Asked Questions

What must an attacker control to exploit this issue?

What is the practical impact beyond confirming file existence?

Are only applications using static file versioning exposed?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker control to exploit this issue?

What is the practical impact beyond confirming file existence?

Are only applications using static file versioning exposed?