CVE-2026-123534
Deferred Deferred - Pending Action

Path Traversal in Tornado Web Framework

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows attackers to hash files outside static_path using ../ sequences. Attackers controlling input passed to static_url() can obtain SHA-512 hashes of readable files to confirm their existence, or reference /dev/zero to block the event loop indefinitely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123534
EUVD
EUVD-2026-119419

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-123534 is a path traversal vulnerability in the Tornado web framework versions before 6.6. It affects functions like static_url() and get_version() which compute version hashes by reading files without validating paths stay within static_path. Attackers can use ../ sequences in untrusted input to force the server to read and hash arbitrary files outside the intended directory, obtaining SHA-512 hashes or blocking the server by targeting /dev/zero.

Detection Guidance

Check Tornado version with pip show tornado. If version is below 6.6.0, the system is vulnerable. Review application code for use of static_url(), get_version(), or StaticFileHandler.make_static_url() with untrusted input. Monitor server logs for unusual file access patterns or excessive CPU usage from hashing operations.

Impact Analysis

This vulnerability allows attackers to obtain sensitive file hashes or cause denial of service by blocking the event loop. It impacts applications passing untrusted input to static_url() or related functions. Typical usage with fixed asset names is unaffected. Workarounds include validating paths or avoiding untrusted input.

Mitigation Strategies

Upgrade Tornado to version 6.6.0 or later. If upgrading is not possible, validate or allowlist paths before passing them to static_url(). Avoid using untrusted input in these functions. Restrict access to sensitive files and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123534. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...