CVE-2026-103263: Tornado StaticFileHandler Path Traversal

CVE-2026-103263 Overview

CVE-2026-103263 is a path traversal vulnerability in the Python Tornado web framework affecting versions before 6.5.9. The flaw resides in StaticFileHandler, which follows symbolic links inside the configured static root without verifying that the resolved target remains within that directory. An unauthenticated remote attacker can request a symlink that points outside the static directory to read arbitrary files accessible to the process user. Impacted files commonly include configuration files, private keys, and application secrets. The weakness is tracked under CWE-59 (Link Following).

Critical Impact
Unauthenticated attackers can read sensitive files outside the static root, including private keys and application secrets, by requesting symlinks placed inside the static directory.

Affected Products

Tornado web framework versions prior to 6.5.9
Python applications using tornado.web.StaticFileHandler to serve static assets
Deployments where symbolic links exist within the configured static root

Discovery Timeline

2026-10-01 - CVE-2026-103263 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-103263

Vulnerability Analysis

Tornado's StaticFileHandler serves files from a configured static root directory. When processing a request, the handler resolves the requested path against the root but does not verify that symbolic links encountered during resolution point to targets within the root. If an operator or a prior process places a symlink inside the static directory that references a location elsewhere on the filesystem, the handler will follow it and serve the external target.

The disclosure impact is limited to file read, with no direct effect on integrity or availability. Any file readable by the Tornado process user becomes reachable over the network through a crafted request. Common targets include /etc/passwd, .env files, TLS private keys, cloud credential files, and application configuration containing database secrets.

Root Cause

The root cause is missing containment validation after path resolution. StaticFileHandler concatenates and normalizes the requested path but does not canonicalize the final resolved path and confirm it is a descendant of the static root. This is a classic link-following weakness [CWE-59] where filesystem indirection bypasses the intended access boundary.

Attack Vector

Exploitation requires an unauthenticated HTTP request. The precondition is that a symlink pointing outside the static root already exists inside it. No user interaction is required. An attacker enumerates or guesses symlink names within the static URL space and issues GET requests to retrieve the linked content. The fix in commit 437ab5f adds verification that resolved paths remain inside the static root. Further detail is available in the GHSA-c2m8-h5v5-343r advisory and the VulnCheck advisory.

Detection Methods for CVE-2026-103263

Indicators of Compromise

HTTP GET requests to static URL paths that return content inconsistent with expected static assets, such as plaintext configuration or key material.
Access log entries targeting unusual filenames under the static route that correspond to symlinks on disk.
Presence of symbolic links inside the Tornado static root whose targets resolve outside that directory.

Detection Strategies

Audit the filesystem under every path passed to StaticFileHandler for symbolic links and record their resolved targets.
Inspect Tornado access logs for 200 responses on static routes serving files with sensitive extensions such as .pem, .key, .env, or .yaml.
Correlate web server telemetry with file-read events on sensitive paths to identify successful retrieval of out-of-root content.

Monitoring Recommendations

Alert on process reads of credential and key material by the Tornado service account outside its expected working directory.
Monitor for creation of new symlinks within directories served by StaticFileHandler.
Baseline normal static-asset response sizes and content types, then alert on deviations.

How to Mitigate CVE-2026-103263

Immediate Actions Required

Upgrade Tornado to version 6.5.9 or later across all Python services using pip install --upgrade tornado.
Enumerate the static roots of every deployed Tornado application and remove symbolic links whose targets lie outside the root.
Rotate secrets, API tokens, and private keys that may have been reachable through an exposed static directory.

Patch Information

The maintainers released Tornado 6.5.9 with the containment check applied in commit 437ab5f. The patch verifies that the resolved target of any served file remains within the configured static root and rejects the request otherwise. Review the GitHub Security Advisory GHSA-c2m8-h5v5-343r for official guidance.

Workarounds

Remove all symbolic links from directories served by StaticFileHandler until upgrades complete.
Run the Tornado process under a least-privilege user that cannot read sensitive files such as TLS keys or environment configuration.
Serve static assets through a hardened reverse proxy such as nginx with disable_symlinks on configured for the static root.

bash

# Configuration example
pip install --upgrade "tornado>=6.5.9"

# nginx reverse proxy hardening for the static location
# location /static/ {
#     disable_symlinks on;
#     alias /var/www/app/static/;
# }