CVE-2026-103263

A flaw was found in Tornado. The StaticFileHandler fails to verify that symbolic links (shortcuts pointing to other files) located within the static root directory resolve within that directory. An unauthenticated remote attacker can exploit this path traversal vulnerability by requesting a path associated with a link pointing outside the intended folder. This can result in unauthorized information disclosure, allowing attackers to access sensitive files on the host filesystem such as configuration files, private keys, and application credentials.

A moderate information-disclosure vulnerability was found in Tornado's StaticFileHandler. Tornado is shipped or depended upon in Red Hat Enterprise Linux (for example the pcs component), Red Hat OpenShift Container Platform, and other Red Hat products that bundle the python-tornado package or pull it in through components such as python-flit and python-pep517. StaticFileHandler resolves requested paths using os.path.abspath() and a string prefix check against the configured static root without resolving symbolic links, while the subsequent file access does follow them. As a result, an unauthenticated remote attacker can request a path that resolves to a symbolic link located inside the static root but pointing outside it and read arbitrary files readable by the server process user, such as configuration files, private keys, and application credentials; no integrity or availability impact is possible. Exploitation requires that a symbolic link pointing outside the static root already exists (or can be created) inside the static directory, for example through build or deployment tooling or user uploads. For this reason Red Hat rates this flaw MODERATE with CVSS:3.1 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), while the upstream CVSS:4.0 score of 8.2 treats the presence of such a link as only a preparatory requirement. Red Hat products whose affected components are resolved as DEFER will not receive a fix at this time because the impact is moderate and the CVSS score is below 7.0; the residual risk is unauthenticated disclosure of files readable by the process user when a symlink pointing outside the static root is present in the served static directory. For community streams such as Fedora and EPEL, a fix is being pursued through the upstream community. Affected Red Hat OpenStack Platform 16.2 components are out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to tornado 6.5.9 or later; as a workaround, avoid symlinks inside static roots served by StaticFileHandler and do not point static roots at directories writable by untrusted processes or mount targets (Docker volumes, npm link).