CVE-2026-103263

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.9

Description A path traversal issue exists in the StaticFileHandler that allows the system to follow symbolic links within the static root without verifying if the resolved target remains inside that directory. This allows unauthenticated attackers to access files outside the static directory, such as configuration files, private keys, and application secrets, provided a symbolic link pointing to those locations exists within the static root.

Recommendations Update Tornado to version 6.5.9 or later.