The vulnerability is a path traversal flaw in Tornado’s RequestHandler.static_url() and get_version() methods. By supplying a user-controlled value that includes traversal sequences such as '..', an attacker can cause the framework to compute SHA‑512 hashes of any readable file outside the intended static directory. This enumeration can confirm the existence or non‑existence of arbitrary files. Additionally, passing a path such as /dev/zero can cause the event loop to block indefinitely, resulting in denial of service. The weakness is classified as CWE-22 and carries a CVSS score of 8.3, reflecting its high potential impact.

All releases of the Tornado web framework prior to version 6.6 are affected. The vendor product is Tornado Web, operated by the Tornadoweb team. The issue exists in the static_url() and get_version() code paths that handle user input without proper sanitisation. Organisations running Python applications that expose Tornado endpoints and rely on these functions must verify that they are not vulnerable.

The high CVSS rating indicates significant severity, yet the Exploit Prediction Scoring System score is not available and the vulnerability is not listed in CISA’s KEV catalogue, meaning no widespread public exploitation has been documented. The likely attack vector is remote over the network: an attacker sends an HTTP request that triggers static_url() or get_version() with a crafted path. Successful exploitation requires the application to call these methods with user‑supplied data, a common pattern in web applications that expose static file handling logic. If an attacker obtains the hash of a sensitive file, they can confirm its presence and choose further attack steps. The denial‑of‑service behaviour can be triggered by pointing the input to /dev/zero, allowing an attacker to freeze the application indefinitely.