CVE-2026-103263
Description
A flaw was found in Tornado. The StaticFileHandler fails to verify that symbolic links (shortcuts pointing to other files) located within the static root directory resolve within that directory. An unauthenticated remote attacker can exploit this path traversal vulnerability by requesting a path associated with a link pointing outside the intended folder. This can result in unauthorized information disclosure, allowing attackers to access sensitive files on the host filesystem such as configuration files, private keys, and application credentials.
Statement
A moderate information-disclosure vulnerability was found in Tornado's StaticFileHandler. Tornado is shipped or depended upon in Red Hat Enterprise Linux (for example the pcs component), Red Hat OpenShift Container Platform, and other Red Hat products that bundle the python-tornado package or pull it in through components such as python-flit and python-pep517. StaticFileHandler resolves requested paths using os.path.abspath() and a string prefix check against the configured static root without resolving symbolic links, while the subsequent file access does follow them. As a result, an unauthenticated remote attacker can request a path that resolves to a symbolic link located inside the static root but pointing outside it and read arbitrary files readable by the server process user, such as configuration files, private keys, and application credentials; no integrity or availability impact is possible. Exploitation requires that a symbolic link pointing outside the static root already exists (or can be created) inside the static directory, for example through build or deployment tooling or user uploads. For this reason Red Hat rates this flaw MODERATE with CVSS:3.1 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), while the upstream CVSS:4.0 score of 8.2 treats the presence of such a link as only a preparatory requirement. Red Hat products whose affected components are resolved as DEFER will not receive a fix at this time because the impact is moderate and the CVSS score is below 7.0; the residual risk is unauthenticated disclosure of files readable by the process user when a symlink pointing outside the static root is present in the served static directory. For community streams such as Fedora and EPEL, a fix is being pursued through the upstream community. Affected Red Hat OpenStack Platform 16.2 components are out of support scope.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 5.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
