Vulnerabilities

TI-2026-38577 CVE-2026-53502 · GHSA-cj54-hpcc-gj6h

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

HIGH 77

Thumbor is an open-source photo thumbnail service by globo.com.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00522 Published 2026-07-31 Fixed in 7.8.0 CWE-22

TI-2026-38580 CVE-2026-53505 · GHSA-phj3-59pf-cp83

HIGH 72

Thumbor is an open-source photo thumbnail service by globo.com.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00609 Published 2026-07-31 Fixed in 7.8.0 CWE-400

TI-2026-38579 CVE-2026-53504 · GHSA-5vjc-7cxw-4w6j

HIGH 72

Thumbor is an open-source photo thumbnail service by globo.com.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00609 Published 2026-07-31 Fixed in 7.8.0 CWE-400

TI-2026-38578 CVE-2026-53503 · GHSA-cqjp-jf4r-h5q9

HIGH 72

Thumbor is an open-source photo thumbnail service by globo.com.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0075 Published 2026-07-31 Fixed in 7.8.0 CWE-20

TI-2026-38576 CVE-2026-53501 · GHSA-mw3h-qjxj-6xg9

MEDIUM 42

Thumbor is an open-source photo thumbnail service by globo.com.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00352 Published 2026-07-31 Fixed in 7.8.0 CWE-347

TI-2026-38575 CVE-2026-53500 · GHSA-6x26-6r6f-m537

HIGH 75

Thumbor is an open-source photo thumbnail service by globo.com.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00498 Published 2026-07-31 Fixed in 7.8.0 CWE-918