GHSA-c2m8-h5v5-343r: Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

StaticFileHandler allows an unauthenticated attacker to read arbitrary files from the server’s filesystem by requesting a path that resolves to a symbolic link placed inside the static root directory. Any application that serves user-uploadable content, or whose static directory is populated by a build/deploy pipeline that creates symlinks (e.g. npm link, webpack, Docker volume mounts, CDN sync tools), is affected. An attacker who can trigger the creation of a symlink pointing outside the static root—or exploit one that already exists—can retrieve sensitive files such as /etc/passwd, private keys, configuration files, or application secrets.