{
  "cveId": "CVE-2026-103263",
  "url": "https://patchblox.com/security/cve/CVE-2026-103263",
  "summary": "CVE-2026-103263 is fixed in 2 products on 1 platform, first by python3-tornado 6.5.4-0.1ubuntu0.2, released October 1, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "python3-tornado: Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside...",
  "description": "Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.",
  "published": "2026-10-01T04:17:00Z",
  "severity": "Medium",
  "epss": 0.00522,
  "epssPercentile": 0.4459,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-tornado",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "4.5.3-1ubuntu0.2\u002Besm4",
      "fix": "python-tornado 4.5.3-1ubuntu0.2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python-tornado-4.5.3-1ubuntu0.2-esm4",
      "released": "2026-10-24T13:26:02Z"
    },
    {
      "platform": "linux",
      "product": "python3-tornado",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "4.5.3-1ubuntu0.2\u002Besm4",
      "fix": "python3-tornado 4.5.3-1ubuntu0.2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python3-tornado-4.5.3-1ubuntu0.2-esm4",
      "released": "2026-10-24T13:26:02Z"
    },
    {
      "platform": "linux",
      "product": "python3-tornado",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "6.1.0-3ubuntu0.1~esm6",
      "fix": "python3-tornado 6.1.0-3ubuntu0.1~esm6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-tornado-6.1.0-3ubuntu0.1-esm6",
      "released": "2026-10-24T13:26:08Z"
    },
    {
      "platform": "linux",
      "product": "python3-tornado",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "6.4.0-1ubuntu0.6",
      "fix": "python3-tornado 6.4.0-1ubuntu0.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-tornado-6.4.0-1ubuntu0.6",
      "released": "2026-10-24T13:26:11Z"
    },
    {
      "platform": "linux",
      "product": "python3-tornado",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "6.5.4-0.1ubuntu0.2",
      "fix": "python3-tornado 6.5.4-0.1ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-python3-tornado-6.5.4-0.1ubuntu0.2",
      "released": "2026-10-01T04:17:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}