Tornado EUVD-2026-90657

Requires an application using tornado.web.StaticFileHandler to serve static files AND a symbolic link that resolves outside the configured static root existing inside that root. Per the advisory, this condition arises in apps serving user-uploadable content, or where the static directory is populated by build/deploy pipelines that create symlinks (npm link, webpack, Docker volume mounts, CDN sync tools); an attacker who can trigger symlink creation or exploit a pre-existing one succeeds. No authentication or user interaction is needed (PR:N/UI:N), and exploitation is purely a GET request. The limiting factor (CVSS 4.0 AT:P) is the symlink precondition: a static tree that never contains out-of-root symlinks is not exploitable. The read is bounded to files accessible to the Tornado process user. Fixed in 6.5.9, which uses os.path.realpath() and adds an opt-in allowed_symlink_directory.

This is a genuine, high-value issue for exposed Tornado deployments but its real-world exploitability hinges on a precondition rather than being a turnkey remote read. The vendor CVSS 4.0 vector (8.2, AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N) correctly captures the key nuance: it is network-reachable and unauthenticated (PR:N/UI:N), with high confidentiality impact (VC:H) and no integrity or availability impact - but it carries AT:P (Attack Requirements: Present), reflecting that a symlink escaping the static root must already exist inside it or be plantable by the attacker. A public PoC exists in the GHSA advisory (full reproduction steps), so weaponization effort is trivial where the precondition holds - but POC availability is NOT active exploitation. There is no EPSS score and no CISA KEV listing in the provided data, so there is no evidence of in-the-wild exploitation. The honest read: this is a real priority for any Tornado app that serves user-uploadable content or whose static dir is populated by build/deploy tooling that creates symlinks (npm link, webpack, Docker volume mounts, CDN sync), and a lower priority for static trees that never contain symlinks. Note a scoring nuance to verify: in CVSS 3.1 terms the symlink precondition is better expressed as AC:H, which would lower the 3.1-equivalent score versus the 8.2 4.0 figure.

An attacker identifies a Tornado application serving files via StaticFileHandler and locates (or, via an upload/build pipeline, plants) a symbolic link inside the static root that points outside it - e.g. to /etc/passwd, a private key, or an app config file. They then issue an unauthenticated GET for that path; os.path.abspath() plus the startswith() prefix check passes because symlinks aren't resolved, while the subsequent os.path.isfile/open follow the link and return the target's contents. A public PoC with complete reproduction steps is published in the GHSA advisory.