Path traversal in Tornado - CVE-2026-123534
Published: November 9, 2026 / Updated: November 10, 2026
Vulnerability identifier: #VU162930
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-123534
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to obtain file hashes outside the static directory and indefinitely block affected Tornado servers.
The vulnerability exists due to missing path containment checks in static_url() when applications pass untrusted input as its path argument, allowing traversal outside static_path. An unauthenticated remote attacker can submit traversal paths to obtain SHA-512 hashes of server-readable files or target /dev/zero to block the event loop indefinitely.
Affected software
Tornado
How to mitigate CVE-2026-123534
Install security update from vendor's website.
Tornado - update to 6.6.0