PT-2026-66836 · Thumbor · Thumbor

CVE-2026-53500 · Published 2026-07-31 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0

Description The ALLOWED SOURCES configuration, designed to restrict the hosts from which the HTTP loader fetches images, fails to escape dots when processing plain-string entries. These strings are passed directly to the re.match() function in the validate() function within thumbor/loaders/http loader.py. Since the dot character acts as a regex wildcard, hostnames that differ only at dot positions can bypass the allowlist, potentially leading to Server-Side Request Forgery (SSRF). This occurs when ALLOW UNSAFE URL is set to True or when user input is forwarded to a signed URL endpoint.

Recommendations Update to version 7.8.0. As a temporary mitigation, restrict the use of plain strings in the ALLOWED SOURCES configuration and instead use compiled regular expression patterns to ensure literal matching of domain names.

Exploit

Fix

SSRF

DoS

Weakness Enumeration

CWE-918

CWE-1333

Related Identifiers

CVE-2026-53500

GHSA-6X26-6R6F-M537

Affected Products

Thumbor

References · 6

• 🔥 https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537 · Exploit
• https://osv.dev/vulnerability/GHSA-6x26-6r6f-m537 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53500 · Security Note
• https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7 · Note
• https://github.com/thumbor/thumbor/releases/tag/7.8.0 · Note
• https://github.com/thumbor/thumbor · Note