CVE-2026-103263 Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink
Unauthenticated attackers can read arbitrary files outside the static directory via symlink traversal in Tornado's StaticFileHandler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-103263?
CVE-2026-103263 is a high-severity path traversal vulnerability in tornadoweb tornado, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
Weakness: CWE-59
Which versions are affected by CVE-2026-103263?
2 open source packages ship an affected version, including tornado.
| Package | Affected | Fixed in |
|---|---|---|
tornado PyPI | All versions | 6.5.9 |
tornado PyPI | All versions | 6.5.9 |
How do I fix CVE-2026-103263?
Upgrade tornado to 6.5.9 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-103263 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-103263 exists.
Sources
Also known as AZL-105375, BELL-CVE-2026-103263, CLEANSTART-2026-YE37392, DEBIAN-CVE-2026-103263, ECHO-dd3a-7510-fb48, GHSA-4cjq-6jh9-w2f5 and 24 more.