Python tornado: Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without… (CVE-2026-103263)

Tornado versions prior to 6.5.9 contain a path traversal vulnerability in the StaticFileHandler component. The handler improperly follows symbolic links inside the static root directory without confirming that the resolved target path stays within the static root. This allows unauthenticated attackers to request symlinks that point outside the static directory, potentially exposing sensitive files accessible by the application process user. The vulnerability is identified as CVE-2026-103263 and affects multiple specific Tornado package versions, including various Ubuntu package builds. The CVSS 3.1 base score is 5.9, with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact.

Exploitation of this vulnerability can lead to unauthorized disclosure of sensitive files such as configuration files, private keys, and application secrets that are accessible to the Tornado process user. This can compromise confidentiality but does not affect integrity or availability. The vulnerability can be exploited remotely without authentication, but requires high attack complexity due to the need to have a symlink inside the static root pointing outside it.

A fix is available in Tornado version 6.5.9 and later. Users should upgrade to Tornado 6.5.9 or newer to remediate this vulnerability. Since this is not a cloud service, manual patching is required. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version cutoff at 6.5.9.