Thumbor has path traversal via post-validation URL decoding bypass in file_loader

The fileloader performs unquote on the file path AFTER the abspath + startswith security check. An attacker can use percent-encoded path traversal sequences %2e%2e for .. that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences. Affected...

CVE-2026-53502

Thumbor (open-source image thumbnail service by globo.com) is affected by a path traversal in file_loader prior to version 7.8.0. The issue occurs because file_loader decodes percent-encoded path segments after root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH via waterma...