Tornado: Path traversal via symlinks in StaticFileHandler

Summary

Tornado before 6.5.9 has a path traversal flaw in StaticFileHandler. It follows symbolic links inside the static directory without checking that their target stays within that directory. An unauthenticated attacker who can request such a link can read files accessible to the Tornado process user, such as configuration files, private keys and application secrets. The attack requires a symlink pointing outside the static root, which may be created by uploads or build and deploy tooling.

Affected

• Tornado versions before 6.5.9 (affected range 0 to below 6.5.9)
• Python packages that depend on Tornado, for example torext 0.10.0, may be affected transitively

Fixed in

• Tornado 6.5.9 (fix commit 437ab5f76565403b3403438d2e555d11f8128d32)
• A newer release, 6.5.10, was referenced in third-party sources but was not verified
• Distribution packages (for example python-tornado) may still be unpatched; check your distribution's tracker

Workaround

• No vendor-documented workaround. Upgrading to 6.5.9 or later is the fix.
• Audit static directories for symlinks that point outside the static root and remove those you do not need.
• Restrict the files readable by the Tornado process user.

Exploitation

• No confirmed exploitation in the wild was found. CISA KEV status was not verified.
• CISA SSVC lists exploitation as 'poc' (a proof of concept exists) and automatable as 'no'.
• The GitHub advisory describes a minimal reproduction; the attack needs only an unauthenticated HTTP request.

Our recommendation

• Check whether any internet-facing or internal Tornado application serves a static directory.
• Update Tornado to 6.5.9 or later, preferably the newest release, and check Python lockfiles and container images for indirect Tornado dependencies.
• Distribution users should apply vendor patches or upgrade via pip where appropriate.
• Audit static directories for unexpected symlinks and review web server logs for requests to unusual static paths.
• Limit the files the application process can read.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Tornado fix commit 437ab5f github.com
• GHSA-c2m8-h5v5-343r advisory github.com
• VulnCheck advisory www.vulncheck.com
• OSV CVE-2026-103263 osv.dev
• Ubuntu security notice CVE-2026-103263 ubuntu.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:38.