AIKIDO-2026-443888
tornado is vulnerable to Path Traversal
72
High Risk
This Affects:
tornadoTL;DR
StaticFileHandler follows symlinks found under the static root without checking that the link target still resides inside that root. A symlink placed inside the static directory that points elsewhere lets a request read files outside the intended static root, disclosing file contents an operator did not intend to serve. The fix resolves and validates each symlink target against the static root and adds an allowed_symlink_directory argument for applications that still need the previous behavior for a specific parent directory.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and serve files with StaticFileHandler from a static root directory that contains a symlink pointing outside that root.
Background info
tornado is vulnerable to Path Traversal in versions 0.2 - 6.5.8.
How to fix this
Upgrade the tornado library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.