Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.

zetlyn/cve-nvd vulnerability cve CVE-2026-103263 known 2026-10-01

https://nvd.nist.gov/vuln/detail/CVE-2026-103263

Properties

cvss	5.9 receipt Source NVD Its words `5.9` Read by `field:cve.metrics.cvssMetricV31[].cvssData.baseScore` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 18:16 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "packageURL": "pkg:pypi/tornado", "product": "tornado", "vendor": "tornadoweb", "versions": [ { "lessThan": "6.5.9", "status": "affected", "version": "0", "versionType": "semver" }, { "status": "unaffected", "version": "6.5.9", "versionType": "semver" } ] } ], "source": "disclosure@vulncheck.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user." } ], "id": "CVE-2026-103263", "lastModified": "2026-10-01T20:17:23.097", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "disclosure@vulncheck.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2026-103263", "options": [ { "exploitation": "poc" }, { "automatable": "no" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2026-10-01T19:29:31.769581Z", "version": "2.0.3" } } ] }, "published": "2026-10-01T11:17:21.233", "references": [ { "source": "disclosure@vulncheck.com", "url": "https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32" }, { "source": "disclosure@vulncheck.com", "url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r" }, { "source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/tornado-before-6.5.9-staticfilehandler-path-traversal-via-symlink" }, { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r" } ], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-59" } ], "source": "disclosure@vulncheck.com", "type": "Secondary" } ] } }
product	tornado receipt Source NVD Its words `tornado` Read by `field:cve.affected[].affectedData[].product` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 18:16 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "packageURL": "pkg:pypi/tornado", "product": "tornado", "vendor": "tornadoweb", "versions": [ { "lessThan": "6.5.9", "status": "affected", "version": "0", "versionType": "semver" }, { "status": "unaffected", "version": "6.5.9", "versionType": "semver" } ] } ], "source": "disclosure@vulncheck.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user." } ], "id": "CVE-2026-103263", "lastModified": "2026-10-01T20:17:23.097", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "disclosure@vulncheck.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2026-103263", "options": [ { "exploitation": "poc" }, { "automatable": "no" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2026-10-01T19:29:31.769581Z", "version": "2.0.3" } } ] }, "published": "2026-10-01T11:17:21.233", "references": [ { "source": "disclosure@vulncheck.com", "url": "https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32" }, { "source": "disclosure@vulncheck.com", "url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r" }, { "source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/tornado-before-6.5.9-staticfilehandler-path-traversal-via-symlink" }, { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r" } ], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-59" } ], "source": "disclosure@vulncheck.com", "type": "Secondary" } ] } }
status	Deferred receipt Source NVD Its words `Deferred` Read by `field:cve.vulnStatus` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 18:16 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "packageURL": "pkg:pypi/tornado", "product": "tornado", "vendor": "tornadoweb", "versions": [ { "lessThan": "6.5.9", "status": "affected", "version": "0", "versionType": "semver" }, { "status": "unaffected", "version": "6.5.9", "versionType": "semver" } ] } ], "source": "disclosure@vulncheck.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user." } ], "id": "CVE-2026-103263", "lastModified": "2026-10-01T20:17:23.097", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "disclosure@vulncheck.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2026-103263", "options": [ { "exploitation": "poc" }, { "automatable": "no" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2026-10-01T19:29:31.769581Z", "version": "2.0.3" } } ] }, "published": "2026-10-01T11:17:21.233", "references": [ { "source": "disclosure@vulncheck.com", "url": "https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32" }, { "source": "disclosure@vulncheck.com", "url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r" }, { "source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/tornado-before-6.5.9-staticfilehandler-path-traversal-via-symlink" }, { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r" } ], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-59" } ], "source": "disclosure@vulncheck.com", "type": "Secondary" } ] } }
vendor	tornadoweb receipt Source NVD Its words `tornadoweb` Read by `field:cve.affected[].affectedData[].vendor` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 18:16 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "packageURL": "pkg:pypi/tornado", "product": "tornado", "vendor": "tornadoweb", "versions": [ { "lessThan": "6.5.9", "status": "affected", "version": "0", "versionType": "semver" }, { "status": "unaffected", "version": "6.5.9", "versionType": "semver" } ] } ], "source": "disclosure@vulncheck.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user." } ], "id": "CVE-2026-103263", "lastModified": "2026-10-01T20:17:23.097", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "disclosure@vulncheck.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2026-103263", "options": [ { "exploitation": "poc" }, { "automatable": "no" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2026-10-01T19:29:31.769581Z", "version": "2.0.3" } } ] }, "published": "2026-10-01T11:17:21.233", "references": [ { "source": "disclosure@vulncheck.com", "url": "https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32" }, { "source": "disclosure@vulncheck.com", "url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r" }, { "source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/tornado-before-6.5.9-staticfilehandler-path-traversal-via-symlink" }, { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r" } ], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-59" } ], "source": "disclosure@vulncheck.com", "type": "Secondary" } ] } }

Text

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.