Threats tagged 'brew-snakeviz-ghsa-c2m8-h5v5-343r'

Python Tornado versions before 6.5.9 have a path traversal vulnerability in StaticFileHandler. This flaw allows the handler to follow symbolic links inside the static root directory without verifying that the resolved target remains within the static root. An unauthenticated attacker can exploit this by requesting a symlink pointing outside the static directory to read sensitive files accessible to the process user, such as configuration files, private keys, and application secrets. The vulnerability has a CVSS score of 5.9, indicating medium severity.