Path traversal in Tornado - #VU164351
Published: November 10, 2026
Vulnerability identifier: #VU164351
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose NTFS alternate data streams attached to files within the static directory on Windows.
The vulnerability exists due to insufficient pathname restrictions in Tornado's StaticFileHandler when processing Windows paths containing alternate data stream names, which pass directory containment checks. A remote attacker can send a request such as GET /static/report.pdf:credentials to read stream contents, potentially exposing credentials or internal source URLs.
Affected software
Tornado
Remediation
Install security update from vendor's website.
Tornado - update to 6.6.1