Tornado static file serving regression fixed in USN-8952-2
Original title: USN-8952-2: Tornado regression
AI summary · x-ai/grok-4.7Summaries by Vani AI
USN-8952-2 corrects incomplete CVE-2026-103263 fix that broke Jupyter static file serving.
Key facts
- Incomplete fix for CVE-2026-103263 in prior update
- Regression affects Jupyter subclasses of StaticFileHandler
Security assessment · AI, from the article
What to do
- 1.Upgrade to USN-8952-2
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103263 | Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the… | 8.2 | — |
From the original article
USN-8952-1 fixed vulnerabilities in Tornado. Unfortunately that update was incomplete due to an incomplete fix for CVE-2026-103263, which broke static file serving for applications that subclass Tornado's StaticFileHandler, such as Jupyter, and could introduce a regression. This update fixes the problem.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.