{"vulnerability": "ghsa-c2m8-h5v5-343r", "sightings": [{"uuid": "df2190d3-9c30-4d42-a587-3dfecab7c5f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-C2M8-H5V5-343R", "type": "seen", "source": "https://gist.github.com/alon710/69dcf85fb66b7f6a1d1eeb1c04587e38", "content": "# GHSA-C2M8-H5V5-343R: GHSA-C2M8-H5V5-343R: Path Traversal via Improper Link Resolution in Tornado StaticFileHandler\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/GHSA-C2M8-H5V5-343R\n\n## Summary\nA path traversal and arbitrary file disclosure vulnerability exists in Tornado's StaticFileHandler. In versions prior to 6.5.9, the handler follows symbolic links that point outside of the configured root static directory. This behavior occurs because the handler performs lexical path validation rather than physical filesystem resolution, allowing unauthenticated remote attackers to read arbitrary files if they can access or control symbolic links within the served static root.\n\n## TL;DR\nTornado's StaticFileHandler prior to 6.5.9 is vulnerable to path traversal and arbitrary file disclosure. By performing lexical validation instead of physical path resolution, the application serves files targeted by symbolic links that point outside the static root.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-59, CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **Impact**: Arbitrary File Disclosure\n- **Exploit Status**: PoC / Functional (via unit tests)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Tornado web framework StaticFileHandler deployments\n- **Tornado**: < 6.5.9 (Fixed in: `6.5.9`)\n\n## Mitigation\n\n- Upgrade to Tornado 6.5.9 or newer\n- Ensure application directories contain no untrusted symbolic links\n- Configure allowed_symlink_directory if out-of-bounds symlinks are functionally required\n- Sanitize and block file uploads containing symlinks (e.g., zip archives)\n\n**Remediation Steps:**\n1. Check current version: pip show tornado\n2. Execute upgrade: pip install --upgrade 'tornado>=6.5.9'\n3. Audit filesystem paths served by StaticFileHandler to locate unexpected symlinks\n4. For necessary symlinks, update tornado configuration initialization to define allowed_symlink_directory\n\n## References\n\n- [GitHub Advisory Entry GHSA-C2M8-H5V5-343R](https://github.com/advisories/GHSA-C2M8-H5V5-343R)\n- [Tornado Pull Request #3719](https://github.com/tornadoweb/tornado/pull/3719)\n- [Tornado v6.5.9 Release Tag](https://github.com/tornadoweb/tornado/releases/tag/v6.5.9)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-C2M8-H5V5-343R) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T06:30:29.000000Z"}]}