CVE-2026-103263

The Tornado web framework (versions before 6.5.9 ) contains a path traversal vulnerability within the StaticFileHandler component. The root cause is that the handler follows symbolic links located inside the static root directory without verifying if the resolved target remains within that direct...