TI-2026-38577 CVE-2026-53502 · GHSA-cj54-hpcc-gj6h
Thumbor has path traversal via post-validation URL decoding bypass in file_loader
Priority HIGH 77
Thumbor is an open-source photo thumbnail service by globo.com.
thumbor
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
thumbor records in CISA KEVNo thumbor vulnerabilities are listed in CISA KEV.
Records
6 records
TI-2026-38575 CVE-2026-53500 · GHSA-6x26-6r6f-m537
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
Priority HIGH 75
Thumbor is an open-source photo thumbnail service by globo.com.
TI-2026-38580 CVE-2026-53505 · GHSA-phj3-59pf-cp83
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
Priority HIGH 72
Thumbor is an open-source photo thumbnail service by globo.com.
TI-2026-38579 CVE-2026-53504 · GHSA-5vjc-7cxw-4w6j
Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
Priority HIGH 72
Thumbor is an open-source photo thumbnail service by globo.com.
TI-2026-38578 CVE-2026-53503 · GHSA-cqjp-jf4r-h5q9
Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
Priority HIGH 72
Thumbor is an open-source photo thumbnail service by globo.com.
TI-2026-38576 CVE-2026-53501 · GHSA-mw3h-qjxj-6xg9
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
Priority MEDIUM 42
Thumbor is an open-source photo thumbnail service by globo.com.