Количество 6
Количество 6
CVE-2026-103263
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
CVE-2026-103263
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
CVE-2026-103263
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
CVE-2026-103263
Tornado before 6.5.9 contains a path traversal vulnerability in Static ...
GHSA-4cjq-6jh9-w2f5
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
BDU:2026-15963
Уязвимость методов get_absolute_path() и validate_absolute_path() асинхронной сетевой библиотеки Tornado, позволяющая нарушителю читать произвольные файлы
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-103263 Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user. | CVSS3: 5.9 | 1% Низкий | 8 дней назад |
 | CVE-2026-103263 Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user. | CVSS3: 5.9 | 1% Низкий | 8 дней назад |
 | CVE-2026-103263 Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user. | CVSS3: 5.9 | 1% Низкий | 8 дней назад |
| CVE-2026-103263 Tornado before 6.5.9 contains a path traversal vulnerability in Static ... | CVSS3: 5.9 | 1% Низкий | 8 дней назад |
| GHSA-4cjq-6jh9-w2f5 Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user. | CVSS3: 5.9 | 1% Низкий | 8 дней назад |
 | BDU:2026-15963 Уязвимость методов get_absolute_path() и validate_absolute_path() асинхронной сетевой библиотеки Tornado, позволяющая нарушителю читать произвольные файлы | CVSS3: 7.5 | 1% Низкий | 26 дней назад |
Уязвимостей на страницу