UBUNTU-CVE-2026-103263: Path Traversal

Q: Which deployments are exposed?

Deployments using Tornado's StaticFileHandler before 6.5.9 are exposed if the configured static root contains a symbolic link whose resolved target is outside that root. The attacker can retrieve only files that are accessible to the process user.

Q: Does exploitation require authentication or a separate server compromise?

No authentication is required. Exploitation depends on an out-of-root symbolic link already being present within the static directory; the provided information does not state that an attacker can create that link through this flaw.

Q: How can I check whether my service may be affected?

Identify Tornado versions before 6.5.9 that use StaticFileHandler, then inspect the configured static root for symbolic links. Resolve each link and determine whether its target falls outside the static root, paying particular attention to targets readable by the application process user.

Q: What can be done before upgrading?

Remove or replace symbolic links in the static root that resolve outside the static directory, and restrict the static root to files intended for public delivery. Also ensure the Tornado process user cannot read sensitive configuration, private keys, or application secrets unnecessarily.

Published Oct 1, 2026

Updated

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.

Affected Software

6 affected componentsFixes available

ubuntu/python-tornado<4.2.1-1ubuntu3.1+esm5

4.2.1-1ubuntu3.1+esm5

ubuntu/python-tornado<4.5.3-1ubuntu0.2+esm5

4.5.3-1ubuntu0.2+esm5

ubuntu/python-tornado<6.1.0-3ubuntu0.1~esm7

6.1.0-3ubuntu0.1~esm7

ubuntu/python-tornado<6.4.0-1ubuntu0.7

6.4.0-1ubuntu0.7

ubuntu/python-tornado<6.5.5-5ubuntu1.2

6.5.5-5ubuntu1.2

ubuntu/python-tornado<6.5.4-0.1ubuntu0.3

6.5.4-0.1ubuntu0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/python-tornado to a version that resolves this vulnerability.
Fixed in 4.2.1-1ubuntu3.1+esm5
Upgrade
Upgrade ubuntu/python-tornado to a version that resolves this vulnerability.
Fixed in 4.5.3-1ubuntu0.2+esm5
Upgrade
Upgrade ubuntu/python-tornado to a version that resolves this vulnerability.
Fixed in 6.1.0-3ubuntu0.1~esm7
Upgrade
Upgrade ubuntu/python-tornado to a version that resolves this vulnerability.
Fixed in 6.4.0-1ubuntu0.7
Upgrade
Upgrade ubuntu/python-tornado to a version that resolves this vulnerability.
Fixed in 6.5.5-5ubuntu1.2
Upgrade
Upgrade ubuntu/python-tornado to a version that resolves this vulnerability.
Fixed in 6.5.4-0.1ubuntu0.3

Event History

Oct 1, 2026

CVE Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Deployments using Tornado's StaticFileHandler before 6.5.9 are exposed if the configured static root contains a symbolic link whose resolved target is outside that root. The attacker can retrieve only files that are accessible to the process user.

Does exploitation require authentication or a separate server compromise?

No authentication is required. Exploitation depends on an out-of-root symbolic link already being present within the static directory; the provided information does not state that an attacker can create that link through this flaw.

How can I check whether my service may be affected?

Identify Tornado versions before 6.5.9 that use StaticFileHandler, then inspect the configured static root for symbolic links. Resolve each link and determine whether its target falls outside the static root, paying particular attention to targets readable by the application process user.

What can be done before upgrading?

Remove or replace symbolic links in the static root that resolve outside the static directory, and restrict the static root to files intended for public delivery. Also ensure the Tornado process user cannot read sensitive configuration, private keys, or application secrets unnecessarily.

UBUNTU-CVE-2026-103263: Path Traversal

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or a separate server compromise?

How can I check whether my service may be affected?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or a separate server compromise?

How can I check whether my service may be affected?

What can be done before upgrading?