CVE-2026-103263
Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
- Record
CVE-2026-103263- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
EUVDEUVD-2026-90657
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
- Record
EUVD-2026-90657- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4cjq-6jh9-w2f5
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows...
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
- Record
GHSA-4cjq-6jh9-w2f5- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
NVD
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
- Record
CVE-2026-103263- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVBELL-CVE-2026-103263
- Record
BELL-CVE-2026-103263- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSV
Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
- Record
CVE-2026-103263- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-59
- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2026-103263
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
- Record
DEBIAN-CVE-2026-103263- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-103263
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
- Record
UBUNTU-CVE-2026-103263- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-06
OSVAZL-105375 No score
CVE-2026-103263 affecting package python-tornado 6.3.3-11
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
- Record
AZL-105375- Updated
- 2026-11-05
OSVUSN-8952-1 No score
python-tornado vulnerabilities
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls.
(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)
- Record
USN-8952-1- Updated
- 2026-11-06
OSVUSN-8952-2 No score
python-tornado regression
USN-8952-1 fixed vulnerabilities in Tornado. Unfortunately that update was incomplete due to an incomplete fix for CVE-2026-103263, which broke static file serving for applications that subclass Tornado's StaticFileHandler, such as Jupyter, and could introduce a regression. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls.
(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)
- Record
USN-8952-2- Updated
- 2026-11-07
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-tornadoAzure Linux:3 |
through 6.3.3-11 | None known |
py3-tornadoAlpaquita:25 |
6.5.1-r0 up to 6.5.10-r0 | 6.5.10-r0 |
py3-tornadoAlpaquita:stream |
6.3.3-r0 up to 6.5.10-r0 | 6.5.10-r0 |
python-tornadoDebian:12 |
All versions, plus listed versions 6.2.0-36.2.0-3+deb12u16.2.0-3+deb12u26.2.0-3+deb12u36.2.0-3+deb12u4 Show 19 moreShow less6.3.2-16.4.0-16.4.0-26.4.1-16.4.1-26.4.1-36.4.2-16.4.2-26.4.2-36.5.2-16.5.2-26.5.2-36.5.4-0.16.5.4-16.5.5-16.5.5-26.5.5-36.5.5-46.5.5-5 |
None known |
python-tornadoDebian:13 |
All versions, plus listed versions 6.4.2-36.4.2-3+deb13u16.4.2-3+deb13u26.5.2-16.5.2-2 Show 8 moreShow less6.5.2-36.5.4-0.16.5.4-16.5.5-16.5.5-26.5.5-36.5.5-46.5.5-5 |
None known |
python-tornadoDebian:14 |
All versions, plus listed versions 6.4.2-36.5.2-16.5.2-26.5.2-36.5.4-0.1 Show 6 moreShow less6.5.4-16.5.5-16.5.5-26.5.5-36.5.5-46.5.5-5 |
None known |
python-tornadoUbuntu:Pro:16.04:LTS |
before 4.2.1-1ubuntu3.1+esm5, plus listed versions 4.2.1-1ubuntu24.2.1-1ubuntu34.2.1-1ubuntu3.14.2.1-1ubuntu3.1+esm14.2.1-1ubuntu3.1+esm24.2.1-1ubuntu3.1+esm34.2.1-1ubuntu3.1+esm4 |
4.2.1-1ubuntu3.1+esm5 |
python-tornadoUbuntu:Pro:18.04:LTS |
before 4.5.3-1ubuntu0.2+esm5, plus listed versions 4.5.1-2.1~build24.5.2-14.5.3-14.5.3-1ubuntu0.14.5.3-1ubuntu0.2 Show 4 moreShow less4.5.3-1ubuntu0.2+esm14.5.3-1ubuntu0.2+esm24.5.3-1ubuntu0.2+esm34.5.3-1ubuntu0.2+esm4 |
4.5.3-1ubuntu0.2+esm5 |
python-tornadoUbuntu:Pro:22.04:LTS |
before 6.1.0-3ubuntu0.1~esm7, plus listed versions 6.1.0-1build16.1.0-26.1.0-36.1.0-3build16.1.0-3ubuntu0.1~esm1 Show 4 moreShow less6.1.0-3ubuntu0.1~esm26.1.0-3ubuntu0.1~esm46.1.0-3ubuntu0.1~esm56.1.0-3ubuntu0.1~esm6 |
6.1.0-3ubuntu0.1~esm7 |
python-tornadoUbuntu:24.04:LTS |
before 6.4.0-1ubuntu0.7, plus listed versions 6.3.2-16.4.0-0ubuntu16.4.0-16.4.0-1build16.4.0-1ubuntu0.1 Show 4 moreShow less6.4.0-1ubuntu0.26.4.0-1ubuntu0.46.4.0-1ubuntu0.56.4.0-1ubuntu0.6 |
6.4.0-1ubuntu0.7 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-tornadoUbuntu:26.10 |
before 6.5.5-5ubuntu1.2, plus listed versions 6.5.4-0.16.5.5-26.5.5-46.5.5-56.5.5-5ubuntu1.1 |
6.5.5-5ubuntu1.2 |
python-tornadoUbuntu:26.04:LTS |
before 6.5.4-0.1ubuntu0.3, plus listed versions 6.4.2-36.5.2-36.5.4-0.16.5.4-0.1ubuntu0.16.5.4-0.1ubuntu0.2 |
6.5.4-0.1ubuntu0.3 |
python-tornadoUbuntu:Pro:16.04:LTS From an advisory covering 6 CVEs |
before 4.2.1-1ubuntu3.1+esm4, plus listed versions 4.2.1-1ubuntu24.2.1-1ubuntu34.2.1-1ubuntu3.14.2.1-1ubuntu3.1+esm14.2.1-1ubuntu3.1+esm24.2.1-1ubuntu3.1+esm3 |
4.2.1-1ubuntu3.1+esm4 |
python-tornadoUbuntu:Pro:18.04:LTS From an advisory covering 6 CVEs |
before 4.5.3-1ubuntu0.2+esm4, plus listed versions 4.5.1-2.1~build24.5.2-14.5.3-14.5.3-1ubuntu0.14.5.3-1ubuntu0.24.5.3-1ubuntu0.2+esm14.5.3-1ubuntu0.2+esm24.5.3-1ubuntu0.2+esm3 |
4.5.3-1ubuntu0.2+esm4 |
python-tornadoUbuntu:Pro:20.04:LTS From an advisory covering 6 CVEs |
before 6.0.3+really5.1.1-3ubuntu0.1~esm7, plus listed versions 5.1.1-4ubuntu15.1.1-4ubuntu56.0.3+really5.1.1-26.0.3+really5.1.1-2build16.0.3+really5.1.1-2build2 Show 4 moreShow less6.0.3+really5.1.1-36.0.3+really5.1.1-3ubuntu0.1~esm16.0.3+really5.1.1-3ubuntu0.1~esm36.0.3+really5.1.1-3ubuntu0.1~esm5 |
6.0.3+really5.1.1-3ubuntu0.1~esm7 |
python-tornadoUbuntu:Pro:22.04:LTS From an advisory covering 6 CVEs |
before 6.1.0-3ubuntu0.1~esm6, plus listed versions 6.1.0-1build16.1.0-26.1.0-36.1.0-3build16.1.0-3ubuntu0.1~esm16.1.0-3ubuntu0.1~esm26.1.0-3ubuntu0.1~esm46.1.0-3ubuntu0.1~esm5 |
6.1.0-3ubuntu0.1~esm6 |
python-tornadoUbuntu:24.04:LTS From an advisory covering 6 CVEs |
before 6.4.0-1ubuntu0.6, plus listed versions 6.3.2-16.4.0-0ubuntu16.4.0-16.4.0-1build16.4.0-1ubuntu0.16.4.0-1ubuntu0.26.4.0-1ubuntu0.46.4.0-1ubuntu0.5 |
6.4.0-1ubuntu0.6 |
python-tornadoUbuntu:26.10 From an advisory covering 6 CVEs |
before 6.5.5-5ubuntu1.1, plus listed versions 6.5.4-0.16.5.5-26.5.5-46.5.5-5 |
6.5.5-5ubuntu1.1 |
python-tornadoUbuntu:26.04:LTS From an advisory covering 6 CVEs |
before 6.5.4-0.1ubuntu0.2, plus listed versions 6.4.2-36.5.2-36.5.4-0.16.5.4-0.1ubuntu0.1 |
6.5.4-0.1ubuntu0.2 |
python-tornadoUbuntu:Pro:20.04:LTS |
before 6.0.3+really5.1.1-3ubuntu0.1~esm8, plus listed versions 5.1.1-4ubuntu15.1.1-4ubuntu56.0.3+really5.1.1-26.0.3+really5.1.1-2build16.0.3+really5.1.1-2build2 Show 5 moreShow less6.0.3+really5.1.1-36.0.3+really5.1.1-3ubuntu0.1~esm16.0.3+really5.1.1-3ubuntu0.1~esm36.0.3+really5.1.1-3ubuntu0.1~esm56.0.3+really5.1.1-3ubuntu0.1~esm7 |
6.0.3+really5.1.1-3ubuntu0.1~esm8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, references | OSV | |
| affected | ||
| facts | OSV | |
| aliases | ||
| affected, aliases | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-103263 is a high vulnerability (CVSS 8.2) in Tornadoweb Tornado, published October 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in py3-tornado 6.5.10-r0.
References
github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
vulncheck.com/advisories/tornado-before-6.5.9-staticfilehandler-path-traversal-via-symlink
nvd.nist.gov/vuln/detail/CVE-2026-103263
docs.bell-sw.com/security/cves/CVE-2026-103263
Show 12 moreShow less
security-tracker.debian.org/tracker/CVE-2026-103263
ubuntu.com/security/CVE-2026-103263
cve.org/CVERecord?id=CVE-2026-103263
launchpad.net/bugs/2172317