Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
TornadoWebServer Improper Link Resolution Before File Access (Link Following) Vulnerability - CVE-2026-103263 - Vulnerability Database
Tornado

TornadoWebServer Improper Link Resolution Before File Access (Link Following) Vulnerability - CVE-2026-103263

Medium
Reference: CVE-2026-103263
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-103263
Title: TornadoWebServer Improper Link Resolution Before File Access (Link Following) Vulnerability
Overview:

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it unauthenticated attackers can request it to read files such as configuration files private keys and application secrets accessible to the process user.