thumbor vulnerabilities

Products

• thumbor 6

Latest thumbor CVEs

Newest publication first

1. CVE-2026-53502 Thumbor has path traversal via post-validation URL decoding bypass in file_loader

   Published 2026-07-31

   High·CVSS 8.7 EPSS 0.52%

   Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through watermark or frame filter input. This issue is fixed in 7...

2. CVE-2026-53505 Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

   Published 2026-07-31

   High·CVSS 7.5 EPSS 0.61%

   Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) an...

3. CVE-2026-53504 Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

   Published 2026-07-31

   High·CVSS 7.5 EPSS 0.61%

   Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0.

4. CVE-2026-53503 Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

   Published 2026-07-31

   High·CVSS 7.5 EPSS 0.75%

   Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a div...

5. CVE-2026-53501 Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

   Published 2026-07-31

   High·CVSS 8.2 EPSS 0.35%

   Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, a...

6. CVE-2026-53500 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

   Published 2026-07-31

   High·CVSS 8.2 EPSS 0.50%

   Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.