Tornado: StaticFileHandler follows symlinks outside static root (path traversal) (High severity, GHSA-c2m8-h5v5-343r)
A high-severity advisory for the pip package tornado is fixed in version 6.5.9.
Key points
- tornado (pip) has a high flaw.
- Tracked as GHSA-c2m8-h5v5-343r.
- Version 6.5.9.
Maintainers of tornado, a package in the pip ecosystem, have published a high-severity security advisory (GHSA-c2m8-h5v5-343r): Tornado: StaticFileHandler follows symlinks outside static root (path traversal).
At a glance
- Advisory
- GHSA-c2m8-h5v5-343r
- CVE
- Not assigned
- Package
- tornado (pip)
- Severity
- High
- Patched in
- 6.5.9
What is the issue?
The GitHub-reviewed advisory explains: Summary StaticFileHandler allows an unauthenticated attacker to read arbitrary files from the server's filesystem by requesting a path that resolves to a symbolic link placed inside the static root directory. Any application that serves user-uploadable content, or whose static directory is populated by a build/deploy pipeline that creates symlinks (e.g. npm link, webpack, Docker volume mounts, CDN sync tools), is affected. An attacker who can trigger the creation of a symlink pointing outside the static root—or exploit one that already exists—can retrieve sensitive files such as /etc/passwd, private keys, configuration files, or application secrets. Details The vulnerability is in tornado.web.StaticFileHandler, specifically in the interaction between two methods in [tornado/web.py](vscode-webview://1grdaaa6v64itrol06qu70pq3d1b9h9im5c3npvvc9snaprc1q9f/tornado/web.py): - [get_absolute_path
Affected versions
| Ecosystem | Package | Vulnerable | Patched |
|---|---|---|---|
| pip | tornado | <= 6.5.8 | 6.5.9 |
How to fix it
- Upgrade the affected package to the first patched version listed above.
- Rebuild and redeploy applications that bundle the vulnerable dependency.
- Run your dependency scanner (npm audit, pip-audit, Dependabot) to find transitive uses.
- Review the advisory references for workaround details if you cannot upgrade yet.
What to do and how to stay safe: GHSA-c2m8-h5v5-343r
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
