Path Traversal Vulnerability in Tornado's StaticFileHandler
Summary
GHSA-c2m8-h5v5-343r: Tornado: StaticFileHandler follows symlinks outside static root (path traversal). Affects tornado versions < 6.5.9. Fixed in 6.5.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Tornado is a Python web framework and asynchronous networking library designed to handle thousands of simultaneous connections efficiently. It is commonly used for building web applications that require long-lived network connections. The StaticFileHandler is a component of Tornado that serves static files to clients. However, it has a vulnerability that allows unauthorized access to files outside of the designated static directory, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability exists in the tornado.web.StaticFileHandler, where the method used to resolve file paths does not properly handle symbolic links. Specifically, the use of os.path.abspath() allows paths that point to symlinks outside the static root to pass validation checks. This can lead to an attacker being able to read sensitive files from the server's filesystem, such as configuration files, private keys, or user data, by exploiting symlinks placed in the static directory.
How To Fix
Latest published version: 6.6.0 as of 23 Oct 2026
pip install --upgrade "tornado==6.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.5.9
This is the first release that contains the fix.
pip install --upgrade "tornado==6.5.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can remove any symbolic links from the static directory or ensure that user-uploaded files do not contain symlinks. Additionally, you can implement access controls to restrict access to sensitive files.
Conclusion
The path traversal vulnerability in Tornado's StaticFileHandler poses a significant risk to applications that serve static files. By updating to the patched version or implementing workarounds, developers can mitigate the risk of unauthorized file access.
See every vulnerability recorded for tornado →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
An attacker can potentially access any file that is readable by the process user, including sensitive files like database credentials, private keys, and configuration files.
No, this vulnerability affects Tornado versions up to 6.5.8. It has been fixed in version 6.5.9 and later.
If you cannot update immediately, consider removing symlinks from the static directory and implementing access controls to limit exposure to sensitive files.
References
Related vulnerabilities
Recent vulnerabilities recorded for tornado.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
