CVE-2026-103263

Publié : 1 octobre 2026

Modifié : 1 octobre 2026

Score CVSS

5.9

MEDIUM

Description détaillée

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Références et Patchs

https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32 https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r https://www.vulncheck.com/advisories/tornado-before-6.5.9-staticfilehandler-path-traversal-via-symlink

Dernières Vulnérabilités

CVE-2026-97297

Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.

VOIR DÉTAILS

CVE-2026-97284

Contributor PHP Object Injection in Icegram <= 3.1.31 versions.

VOIR DÉTAILS

CVE-2026-97281

Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.

VOIR DÉTAILS