CVE-2026-103263
published 2026-10-01CVE-2026-103263: Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the…
PriorityP340medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
0.52%
43.4th percentile
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
Affected
64 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| clusterlabs | pcs | — | — |
| debian | python-tornado | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| mta | mta-solution-server-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| rhel10 | keylime-registrar | — | — |
| rhel10 | keylime-verifier | — | — |
| rhel9 | keylime-registrar | — | — |
| rhel9 | keylime-verifier | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhelai3 | disk-image-cuda-rhel9 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
tornado: Tornado: Information disclosure via symlink path traversal in StaticFileHandler
vendor_redhat·2026-10-01·CVSS 5.9
CVE-2026-103263 [MEDIUM] CWE-59 tornado: Tornado: Information disclosure via symlink path traversal in StaticFileHandler
tornado: Tornado: Information disclosure via symlink path traversal in StaticFileHandler
A flaw was found in Tornado. The StaticFileHandler fails to verify that symbolic links (shortcuts pointing to other files) located within the static root directory resolve within that directory. An unauthenticated remote attacker can exploit this path traversal vulnerability by requesting a path associated with a link pointing outside the intended folder. This can result in unauthorized information disclosure, allowing attackers to access sensitive files on the host filesystem such as configuration files, private keys, and application credentials.
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Core) - Fix deferred
Package: lightspeed-core/rag-tool-cpu-rhel9 (Lightspeed Core) - Fix defer
GHSA
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it.
ghsa_unreviewed·2026-10-01
CVE-2026-103263 [HIGH] CWE-59 Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it.
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-103263 python-pep517: Tornado: Information disclosure via symlink path traversal in StaticFileHandler [epel-all]
bugzilla·2026-10-22·CVSS 5.9
CVE-2026-103263 [MEDIUM] CVE-2026-103263 python-pep517: Tornado: Information disclosure via symlink path traversal in StaticFileHandler [epel-all]
CVE-2026-103263 python-pep517: Tornado: Information disclosure via symlink path traversal in StaticFileHandler [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
Bugzilla
CVE-2026-103263 python-flit: Tornado: Information disclosure via symlink path traversal in StaticFileHandler [epel-all]
bugzilla·2026-10-22·CVSS 5.9
CVE-2026-103263 [MEDIUM] CVE-2026-103263 python-flit: Tornado: Information disclosure via symlink path traversal in StaticFileHandler [epel-all]
CVE-2026-103263 python-flit: Tornado: Information disclosure via symlink path traversal in StaticFileHandler [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
Bugzilla
CVE-2026-103263 python-flit: Tornado: Information disclosure via symlink path traversal in StaticFileHandler [fedora-all]
bugzilla·2026-10-22·CVSS 5.9
CVE-2026-103263 [MEDIUM] CVE-2026-103263 python-flit: Tornado: Information disclosure via symlink path traversal in StaticFileHandler [fedora-all]
CVE-2026-103263 python-flit: Tornado: Information disclosure via symlink path traversal in StaticFileHandler [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
Bugzilla
CVE-2026-103263 tornado: Tornado: Information disclosure via symlink path traversal in StaticFileHandler
bugzilla·2026-10-01·CVSS 5.9
CVE-2026-103263 [MEDIUM] CVE-2026-103263 tornado: Tornado: Information disclosure via symlink path traversal in StaticFileHandler
CVE-2026-103263 tornado: Tornado: Information disclosure via symlink path traversal in StaticFileHandler
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343rhttps://www.vulncheck.com/advisories/tornado-before-6.5.9-staticfilehandler-path-traversal-via-symlinkhttps://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
2026-10-01
Published