All vulnerabilities
CVE-2026-103263GHSA-c2m8-h5v5-343r

Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink

tornadoweb tornadoPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 1 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.52%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.5.9Fixed versionCVE List
Published1 Oct 2026Updated 2 Oct 2026CVE List

What fixes it

  • 6.5.9tornadoCVE List
  • 6.5.9tornado, PyPIOSVpip install "tornado>=6.5.9"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.

Text from CVE List

Affected versions 53

  • tornadoaffected: all versions before 6.5.9CVE List
  • tornadounaffected: 6.5.9CVE List
  • tornado, PyPIfrom first release, fixed in 6.5.9OSV
  • tornado, PyPI0.2OSV
  • tornado, PyPI1.0OSV
  • tornado, PyPI1.1OSV
  • tornado, PyPI1.1.1OSV
  • tornado, PyPI1.2OSV
  • tornado, PyPI1.2.1OSV
  • tornado, PyPI2.0OSV
  • tornado, PyPI2.1OSV
  • tornado, PyPI2.1.1OSV
  • tornado, PyPI2.2OSV
  • tornado, PyPI2.2.1OSV
  • tornado, PyPI2.3OSV
  • tornado, PyPI2.4OSV
  • tornado, PyPI2.4.1OSV
  • tornado, PyPI3.0OSV
  • tornado, PyPI3.0.1OSV
  • tornado, PyPI3.0.2OSV
  • tornado, PyPI3.1OSV
  • tornado, PyPI3.1.1OSV
  • tornado, PyPI3.2OSV
  • tornado, PyPI3.2.1OSV
  • tornado, PyPI3.2.2OSV
  • tornado, PyPI4.0OSV
  • tornado, PyPI4.0.1OSV
  • tornado, PyPI4.0.2OSV
  • tornado, PyPI4.1OSV
  • tornado, PyPI4.1b2OSV
  • tornado, PyPI4.2OSV
  • tornado, PyPI4.2.1OSV
  • tornado, PyPI4.2b1OSV
  • tornado, PyPI4.3OSV
  • tornado, PyPI4.3b1OSV
  • tornado, PyPI4.3b2OSV
  • tornado, PyPI4.4OSV
  • tornado, PyPI4.4.1OSV
  • tornado, PyPI4.4.2OSV
  • tornado, PyPI4.4.3OSV
  • tornado, PyPI4.4b1OSV
  • tornado, PyPI4.5OSV
  • tornado, PyPI4.5.1OSV
  • tornado, PyPI4.5.2OSV
  • tornado, PyPI4.5.3OSV
  • tornado, PyPI4.5b1OSV
  • tornado, PyPI4.5b2OSV
  • tornado, PyPI5.0OSV
  • tornado, PyPI5.0.1OSV
  • tornado, PyPI5.0.2OSV
  • tornado, PyPI5.0a1OSV
  • tornado, PyPI5.0b1OSV
  • tornado, PyPI5.1OSV

References 3