113 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-53501
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's HMAC validation can be bypassed due to the use of Python's .replace wh...
Linux Distros Unpatched Vulnerability : CVE-2026-53505
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion filter does not enforce an upper bound on and runs ...
Linux Distros Unpatched Vulnerability : CVE-2026-53500
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escapi...
Linux Distros Unpatched Vulnerability : CVE-2026-53504
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on...
Linux Distros Unpatched Vulnerability : CVE-2026-53503
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution, , filter passes the user-controlled value to a C...
Linux Distros Unpatched Vulnerability : CVE-2026-53502
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary...
Thumbor has path traversal via post-validation URL decoding bypass in file_loader
The fileloader performs unquote on the file path AFTER the abspath + startswith security check. An attacker can use percent-encoded path traversal sequences %2e%2e for .. that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences. Affected...
PYSEC-2026-3617 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...
PYSEC-2026-3618 Thumbor has path traversal via post-validation URL decoding bypass in file_loader
The fileloader performs unquote on the file path AFTER the abspath + startswith security check. An attacker can use percent-encoded path traversal sequences %2e%2e for .. that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences. Affected code...
PYSEC-2026-3621 Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
Summary Thumbor's filters:proportion filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes CPU/memory exhaustion and cause denial of service. Details - Filter implementation: thumbor/filters/proportion.py - value is parsed ...
Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
SummaryThumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the C code triggers undefined behavior; on x8664 this reliably results in a...
PYSEC-2026-3620 Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
HMAC validation bypass via multiple .replace calls when removing URL signature Summary Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can...
PYSEC-2026-3619 Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
Summary Thumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the C code triggers undefined behavior; on x8664 this reliably results in a...
Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
SummaryThe regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service ReDoS. DetailsThe RegExp for convolution is defined as...
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
HMAC validation bypass via multiple .replace calls when removing URL signature SummaryThumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can...
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
SummaryThe ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
SummaryThumbor's filters:proportion filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes CPU/memory exhaustion and cause denial of service. Details- Filter implementation: thumbor/filters/proportion.py - value is parsed as...
PYSEC-2026-3616 Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
Summary The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service ReDoS. Details The RegExp for convolution is defined as...
CVE-2026-53500
creationtimestamp| type| source ---|---|--- 2026-07-31 20:35:31+00:00| published-proof-of-concept| https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537 2026-07-31 23:01:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mry2phugqg2b...