CVE-2026-53501: fallo de gravedad alta en thumbor
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.2epss 0.4%
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation. This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths. This issue is fixed in 7.8.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Productos afectados
thumbor · thumborCVEs relacionadas — thumbor
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-53503HIGHThumbor convolution filter allows divide-by-zero in C extension leading to remote DoSEPSS 0.8%CVE-2026-53505HIGHThumbor proportion filter allows unbounded post-transform resize leading to remote DoSEPSS 0.6%CVE-2026-53504HIGHThumbor has Regex Denial of Service (ReDoS) in `convolution` filterEPSS 0.6%CVE-2026-53502HIGHThumbor has path traversal via post-validation URL decoding bypass in file_loaderEPSS 0.5%CVE-2026-53500HIGHThumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dotEPSS 0.5%