PyPI/tornado CVE-2026-103263: medium 5.9, EPSS 0.52%

Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

Action: Upgrade tornado to 6.5.9 or later.

pip install tornado==6.5.9

Affected

Fixed versions

Sources

• osv: GHSA-c2m8-h5v5-343r
• nvd: CVE-2026-103263
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
• https://github.com/tornadoweb/tornado/pull/3719
• https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32
• https://github.com/tornadoweb/tornado/commit/f9f50b8bab265a2abf9f2415a3d2da6264a5450b
• https://github.com/tornadoweb/tornado
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.9

CVE-2026-103263 · published 2026-09-30T23:48:55Z · modified 2026-10-02T03:56:10.964622908Z · JSON