HighFix available
python-tornado — security advisory
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
- Products
- python-tornado
- Affected versions
- 4.2.1-1ubuntu2, 4.2.1-1ubuntu3, 4.2.1-1ubuntu3.1, 4.2.1-1ubuntu3.1+esm1, 4.2.1-1ubuntu3.1+esm2, 4.2.1-1ubuntu3.1+esm3, 4.5.1-2.1~build2, 4.5.2-1, 4.5.3-1, 4.5.3-1ubuntu0.1, 4.5.3-1ubuntu0.2, 4.5.3-1ubuntu0.2+esm1, 4.5.3-1ubuntu0.2+esm2, 4.5.3-1ubuntu0.2+esm3, 6.1.0-1build1, 6.1.0-2, 6.1.0-3, 6.1.0-3build1, 6.1.0-3ubuntu0.1~esm1, 6.1.0-3ubuntu0.1~esm2, 6.1.0-3ubuntu0.1~esm4, 6.1.0-3ubuntu0.1~esm5, 6.3.2-1, 6.4.0-0ubuntu1, 6.4.0-1, 6.4.0-1build1, 6.4.0-1ubuntu0.1, 6.4.0-1ubuntu0.2, 6.4.0-1ubuntu0.4, 6.4.0-1ubuntu0.5, 6.4.2-3, 6.5.2-3, 6.5.4-0.1, 6.5.4-0.1ubuntu0.1
- Fixed versions
- 4.2.1-1ubuntu3.1+esm4, 4.5.3-1ubuntu0.2+esm4, 6.1.0-3ubuntu0.1~esm6, 6.4.0-1ubuntu0.6, 6.5.4-0.1ubuntu0.2
- CVEs
- CVE-2026-103263
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 19:31 UTC · Revision 1
Source evidence
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
osv:UBUNTU-CVE-2026-103263
python-tornado
Fixed versions: 4.2.1-1ubuntu3.1+esm4
python-tornado
Fixed versions: 4.5.3-1ubuntu0.2+esm4
python-tornado
Fixed versions: 6.1.0-3ubuntu0.1~esm6
python-tornado
Fixed versions: 6.4.0-1ubuntu0.6
python-tornado
Fixed versions: 6.5.4-0.1ubuntu0.2
Complete source record
{
"id": "ec2da1ecc4ab5fa4430a76b9705cfd2179b5dd429a701245c4030a486300f0ea",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-103263",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-103263",
"summary": "Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.",
"evidence": "osv:UBUNTU-CVE-2026-103263",
"products": [
{
"name": {
"value": "python-tornado",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.2.1-1ubuntu3.1+esm4",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "4.2.1-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.1-1ubuntu3",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.1-1ubuntu3.1",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.1-1ubuntu3.1+esm1",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.1-1ubuntu3.1+esm2",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.1-1ubuntu3.1+esm3",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "python-tornado",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.5.3-1ubuntu0.2+esm4",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "4.5.1-2.1~build2",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.2-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.3-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.3-1ubuntu0.1",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.3-1ubuntu0.2",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.3-1ubuntu0.2+esm1",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.3-1ubuntu0.2+esm2",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.3-1ubuntu0.2+esm3",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "python-tornado",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.1.0-3ubuntu0.1~esm6",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "6.1.0-1build1",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-2",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-3",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-3build1",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-3ubuntu0.1~esm1",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-3ubuntu0.1~esm2",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-3ubuntu0.1~esm4",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-3ubuntu0.1~esm5",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "python-tornado",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.4.0-1ubuntu0.6",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "6.3.2-1",
"evidence": "/affected/3/versions"
},
{
"value": "6.4.0-0ubuntu1",
"evidence": "/affected/3/versions"
},
{
"value": "6.4.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "6.4.0-1build1",
"evidence": "/affected/3/versions"
},
{
"value": "6.4.0-1ubuntu0.1",
"evidence": "/affected/3/versions"
},
{
"value": "6.4.0-1ubuntu0.2",
"evidence": "/affected/3/versions"
},
{
"value": "6.4.0-1ubuntu0.4",
"evidence": "/affected/3/versions"
},
{
"value": "6.4.0-1ubuntu0.5",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "python-tornado",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.5.4-0.1ubuntu0.2",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": [
{
"value": "6.4.2-3",
"evidence": "/affected/4/versions"
},
{
"value": "6.5.2-3",
"evidence": "/affected/4/versions"
},
{
"value": "6.5.4-0.1",
"evidence": "/affected/4/versions"
},
{
"value": "6.5.4-0.1ubuntu0.1",
"evidence": "/affected/4/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-103263",
"aliases": [
"UBUNTU-CVE-2026-103263"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.1-1ubuntu3.1+esm4"
}
]
}
],
"package": {
"name": "python-tornado",
"purl": "pkg:deb/ubuntu/python-tornado?arch=source&distro=esm-infra-legacy%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"4.2.1-1ubuntu2",
"4.2.1-1ubuntu3",
"4.2.1-1ubuntu3.1",
"4.2.1-1ubuntu3.1+esm1",
"4.2.1-1ubuntu3.1+esm2",
"4.2.1-1ubuntu3.1+esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103263.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-tornado",
"binary_version": "4.2.1-1ubuntu3.1+esm4"
},
{
"binary_name": "python3-tornado",
"binary_version": "4.2.1-1ubuntu3.1+esm4"
}
],
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.3-1ubuntu0.2+esm4"
}
]
}
],
"package": {
"name": "python-tornado",
"purl": "pkg:deb/ubuntu/python-tornado?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"4.5.1-2.1~build2",
"4.5.2-1",
"4.5.3-1",
"4.5.3-1ubuntu0.1",
"4.5.3-1ubuntu0.2",
"4.5.3-1ubuntu0.2+esm1",
"4.5.3-1ubuntu0.2+esm2",
"4.5.3-1ubuntu0.2+esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103263.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-tornado",
"binary_version": "4.5.3-1ubuntu0.2+esm4"
},
{
"binary_name": "python3-tornado",
"binary_version": "4.5.3-1ubuntu0.2+esm4"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.0-3ubuntu0.1~esm6"
}
]
}
],
"package": {
"name": "python-tornado",
"purl": "pkg:deb/ubuntu/python-tornado?arch=source&distro=esm-apps%2Fjammy",
"ecosystem": "Ubuntu:Pro:22.04:LTS"
},
"versions": [
"6.1.0-1build1",
"6.1.0-2",
"6.1.0-3",
"6.1.0-3build1",
"6.1.0-3ubuntu0.1~esm1",
"6.1.0-3ubuntu0.1~esm2",
"6.1.0-3ubuntu0.1~esm4",
"6.1.0-3ubuntu0.1~esm5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103263.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-tornado",
"binary_version": "6.1.0-3ubuntu0.1~esm6"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.0-1ubuntu0.6"
}
]
}
],
"package": {
"name": "python-tornado",
"purl": "pkg:deb/ubuntu/python-tornado?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"6.3.2-1",
"6.4.0-0ubuntu1",
"6.4.0-1",
"6.4.0-1build1",
"6.4.0-1ubuntu0.1",
"6.4.0-1ubuntu0.2",
"6.4.0-1ubuntu0.4",
"6.4.0-1ubuntu0.5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103263.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-tornado",
"binary_version": "6.4.0-1ubuntu0.6"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.5.4-0.1ubuntu0.2"
}
]
}
],
"package": {
"name": "python-tornado",
"purl": "pkg:deb/ubuntu/python-tornado?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"6.4.2-3",
"6.5.2-3",
"6.5.4-0.1",
"6.5.4-0.1ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103263.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-tornado",
"binary_version": "6.5.4-0.1ubuntu0.2"
}
],
"availability": "No subscription required"
}
}
],
"modified": "2026-10-22T23:19:38.517525230Z",
"provider": "osv",
"upstream": [
"CVE-2026-103263"
],
"references": [
"https://ubuntu.com/security/CVE-2026-103263",
"https://www.cve.org/CVERecord?id=CVE-2026-103263",
"https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r",
"https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32",
"https://www.vulncheck.com/advisories/tornado-before-6.5.9-staticfilehandler-path-traversal-via-symlink",
"https://ubuntu.com/security/notices/USN-8952-1"
]
},
"related_cves": [
{
"value": "CVE-2026-103263",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/1/score"
},
"source_id": "core-osv",
"document_id": 410106,
"published_at": "2026-10-01T11:17:00+00:00"
}