Thumbor: Four Vulnerabilities Including Path Traversal and DoS Disclosed Together
Key findings • Four vulnerabilities in Globo.com's Thumbor disclosed on August 1, 2026. • Path traversal vulnerability (CVE-2026-53502) allows access outside designated directories. • HMA…
Key findings
- Four vulnerabilities in Globo.com's Thumbor disclosed on August 1, 2026.
- Path traversal vulnerability (CVE-2026-53502) allows access outside designated directories.
- HMAC signature validation bypass (CVE-2026-53501) due to improper string replacement.
- Two denial-of-service vulnerabilities (CVE-2026-53505, CVE-2026-53504) exploit image filters and regex patterns.
- All issues are fixed in Thumbor version 7.8.0.
On August 1, 2026, a batch of four vulnerabilities was disclosed for Globo.com's Thumbor, an open-source photo thumbnail service. The vulnerabilities, all patched in version 7.8.0, collectively pose risks ranging from arbitrary file access to denial-of-service conditions. The disclosures highlight potential weaknesses in how Thumbor handles user-supplied input, particularly concerning file paths, signature validation, and resource-intensive image processing operations.
One of the disclosed vulnerabilities, CVE-2026-53502, allows for path traversal outside the configured FILE_LOADER_ROOT_PATH. This occurs because the file_loader component decodes percent-encoded path segments after initial root-boundary validation. Attackers can exploit this by manipulating watermark or frame filter inputs to access files beyond the intended directory.
Another critical issue, CVE-2026-53501, involves a bypass of Thumbor's HMAC signature validation. The vulnerability stems from the use of Python's .replace() method, which removes all occurrences of a substring. This allows an attacker to craft a URL where the signature is present multiple times, leading to a successful bypass and potentially unauthorized access or manipulation of image processing requests.
Denial-of-service (DoS) vulnerabilities were also detailed. CVE-2026-53505, related to the filters:proportion(<value>) filter, does not enforce an upper bound on the <value> parameter. When executed in the post-transform phase, this can lead to extremely large image resizes, consuming excessive CPU and memory resources and resulting in a DoS. Similarly, CVE-2026-53504 describes a DoS vulnerability in the convolution filter. A crafted URL can trigger exponential backtracking in the filter's regular expression, exhausting processing time for a given request.
All four vulnerabilities were addressed in Thumbor version 7.8.0. Users are strongly advised to update to this version to mitigate the identified risks. The coordinated disclosure of these issues on a single day underscores the importance of timely patching for systems utilizing Thumbor to prevent potential exploitation of these diverse security weaknesses.