CVE-2026-53501: high-severity vulnerability in thumbor
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 0.4%
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation. This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths. This issue is fixed in 7.8.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Affected products
thumbor · thumborRelated CVEs — thumbor
In the same product, most dangerous first.
CVE-2026-53503HIGHThumbor convolution filter allows divide-by-zero in C extension leading to remote DoSEPSS 0.8%CVE-2026-53505HIGHThumbor proportion filter allows unbounded post-transform resize leading to remote DoSEPSS 0.6%CVE-2026-53504HIGHThumbor has Regex Denial of Service (ReDoS) in `convolution` filterEPSS 0.6%CVE-2026-53502HIGHThumbor has path traversal via post-validation URL decoding bypass in file_loaderEPSS 0.5%CVE-2026-53500HIGHThumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dotEPSS 0.5%