CVE-2026-103263
1 advisory.
PyPI/tornado CVE-2026-103263: high, EPSS 0.52%
Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
Action: Upgrade tornado to 6.5.9 or later.
pip install tornado==6.5.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.5.9 | - |
Fixed versions
| 6.5.9 |
Sources
- osv: GHSA-c2m8-h5v5-343r
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
- https://github.com/tornadoweb/tornado/pull/3719
- https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32
- https://github.com/tornadoweb/tornado/commit/f9f50b8bab265a2abf9f2415a3d2da6264a5450b
- https://github.com/tornadoweb/tornado
- https://github.com/tornadoweb/tornado/releases/tag/v6.5.9
CVE-2026-103263 · published · modified · JSON