SB20261110255 - Multiple vulnerabilities in Tornado

Description

This security bulletin contains information about 2 vulnerabilities.

1) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose NTFS alternate data streams attached to files within the static directory on Windows.

The vulnerability exists due to insufficient pathname restrictions in Tornado's StaticFileHandler when processing Windows paths containing alternate data stream names, which pass directory containment checks. A remote attacker can send a request such as GET /static/report.pdf:credentials to read stream contents, potentially exposing credentials or internal source URLs.

2) Open redirect (CVE-ID: CVE-2026-126347)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to redirect users to an untrusted website.

The vulnerability exists due to inconsistent URL parsing between browsers and Python's urllib in Tornado's RedirectHandler when validating redirect paths starting with three or more slashes. A remote attacker can trick a user into following a crafted link with a triple-slash redirect path to bypass open-redirect detection and redirect the browser to an untrusted website.

Remediation

Install update from vendor's website.

References

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-p3r8-9mfh-25p7
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-5cjw-f85j-cv6r