Is CVE-2026-103263 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103263 being exploited in the wild.

How severe is CVE-2026-103263?

Medium severity, with a CVSS score of 5.9, published 1 October 2026.

Which products and versions are affected?

tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.5.9; Tornado Project Tornado <=6.5.8.

Is there a fix for CVE-2026-103263?

Yes. tornado (PyPI): upgrade to 6.5.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-103263 attacked?

It is attacked over the network.

Am I affected by CVE-2026-103263?

Check whether you run tornado (PyPI) or Tornado Project Tornado at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103263: Tornado StaticFileHandler path traversal via symlinks

Q: Is there a fix for CVE-2026-103263?

Yes. tornado (PyPI): upgrade to 6.5.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-103263 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-103263?

Check whether you run tornado (PyPI) or Tornado Project Tornado at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103263 · Severity: medium · CVSS 5.9 · Published 2026-10-01

Tornado is a Python web framework whose StaticFileHandler serves static files to web users. An attacker can read arbitrary files from the server—including secrets, private keys, and configuration files—by requesting symlinks placed in the static directory that point outside it. This affects applications that serve user-uploaded content or use build tools that create symlinks, allowing unauthenticated file disclosure.

Technologies: tornado (PyPI), Tornado Project Tornado. Vendors: PyPI, Tornado Project.

Quick answers

Is CVE-2026-103263 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103263 being exploited in the wild.
How severe is CVE-2026-103263?: Medium severity, with a CVSS score of 5.9, published 1 October 2026.
Which products and versions are affected?: tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.5.9; Tornado Project Tornado <=6.5.8.
Is there a fix for CVE-2026-103263?: Yes. tornado (PyPI): upgrade to 6.5.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103263 attacked?: It is attacked over the network.
Am I affected by CVE-2026-103263?: Check whether you run tornado (PyPI) or Tornado Project Tornado at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tornado (PyPI): upgrade to 6.5.9 or later
```
pip install "tornado>=6.5.9"
```

Technical details

The vulnerability exists in tornado.web.StaticFileHandler where get_absolute_path() and validate_absolute_path() use os.path.abspath() instead of os.path.realpath(). Since abspath() normalizes . and .. but does not resolve symlinks, a request to /static/link passes the prefix check even if the symlink points outside the static root; subsequent os.path.exists() and os.path.isfile() calls follow the symlink, allowing access to arbitrary files. An unauthenticated remote attacker can read any file accessible to the process user.

Affected products

Tornado Project Tornado <=6.5.8

Identifiers

CVE-2026-103263
GHSA-c2m8-h5v5-343r

Timeline

2026-09-30: disclosed
2026-09-14: patched: Version 6.5.9 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.