Is CVE-2026-123534 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123534 being exploited in the wild.

How severe is CVE-2026-123534?

Medium severity, with a CVSS score of 6.5, published 8 November 2026.

How is CVE-2026-123534 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123534?

Check whether you run Tornadoweb Tornado at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123534: Tornado path traversal in static_url() and get_version()

CVE-2026-123534 · Severity: medium · CVSS 6.5 · Published 2026-11-08

Tornado is a Python web framework that handles HTTP requests and serves static files. A path traversal vulnerability in its static file handling allows attackers who control input to static_url() to read and hash files outside the intended directory, or to cause denial-of-service by accessing infinite-read devices like /dev/zero. This affects applications that pass untrusted input to static_url(), though typical template-based usage is safe.

Technologies: Tornadoweb Tornado. Vendors: Tornadoweb.

Quick answers

Is CVE-2026-123534 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123534 being exploited in the wild.
How severe is CVE-2026-123534?: Medium severity, with a CVSS score of 6.5, published 8 November 2026.
Which products and versions are affected?: Tornadoweb Tornado before 6.6.
Is there a fix for CVE-2026-123534?: Yes: fixed in Tornado 6.6.0. Until then: Validate or allowlist any path passed to static_url(), or avoid passing request-derived values to it. Ensure only fixed asset names are used in templates. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123534 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123534?: Check whether you run Tornadoweb Tornado at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Tornado 6.6.0

Validate or allowlist any path passed to static_url(), or avoid passing request-derived values to it. Ensure only fixed asset names are used in templates.

Technical details

The static_url() and get_version() methods compute SHA-512 hashes of files for versioning but do not validate that file paths stay within static_path, allowing ../ traversal sequences to escape the restricted directory. An attacker can hash arbitrary readable files to confirm their existence or block the event loop indefinitely by referencing special files. The vulnerability requires the application to pass untrusted input to static_url().

Affected products

tornadoweb Tornado before 6.6

Timeline

2026-10-22: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.