Bug 2544519 (CVE-2026-103263)

Summary: CVE-2026-103263 tornado: Tornado: Information disclosure via symlink path traversal in StaticFileHandler
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, anpicker, aos-team-art-private, asdas, bbrownin, bparees, dpaolell, dschmidt, ebourniv, eglynn, hasun, ikhan, jdelft, jfula, jjoyce, jlanda, jowilson, jpretori, jschluet, jupierce, jwong, kaycoth, kshier, lgarciaa, lhh, mbiarnes, mburns, mgarciac, nyancey, omaciel, ometelka, ppalepu, ppostler, prdhamdh, ptisnovs, rbobbitt, rhel-process-autobot, rjohnson, sbunciak, sghai, sidsharm, simaishi, stcannon, suppawar, syedriko, ttakamiy, vlaad, watson-tool-maintainers, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Tornado. The StaticFileHandler fails to verify that symbolic links (shortcuts pointing to other files) located within the static root directory resolve within that directory. An unauthenticated remote attacker can exploit this path traversal vulnerability by requesting a path associated with a link pointing outside the intended folder. This can result in unauthorized information disclosure, allowing attackers to access sensitive files on the host filesystem such as configuration files, private keys, and application credentials.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-01 10:53:11 UTC 
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.