CVE-2026-53502highCWE-22

CVE-2026-53502: fallo de gravedad alta en thumbor

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Publicada el

Seguir esta CVE+ Monitorear thumbor+ Monitorear thumbor

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.5%
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through watermark or frame filter input. This issue is fixed in 7.8.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
thumbor · thumbor
CVEs relacionadas — thumbor

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-53503HIGHThumbor convolution filter allows divide-by-zero in C extension leading to remote DoSEPSS 0.8%CVE-2026-53505HIGHThumbor proportion filter allows unbounded post-transform resize leading to remote DoSEPSS 0.6%CVE-2026-53504HIGHThumbor has Regex Denial of Service (ReDoS) in `convolution` filterEPSS 0.6%CVE-2026-53500HIGHThumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dotEPSS 0.5%CVE-2026-53501HIGHThumbor has HMAC validation bypass via multiple .replace() calls when removing URL signatureEPSS 0.4%