PT-2026-66838 · Thumbor · Thumbor

CVE-2026-53501 · Published 2026-07-31 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0

Description HMAC validation can be bypassed due to the use of the Python .replace() method when removing the signature from the URL before validation. Because .replace() removes all occurrences of the substring rather than just the first one, an attacker can inject multiple copies of the signature into the URL. This results in a validated string that differs from the actual requested resource, allowing the loading of images from unintended domains or paths and potentially turning the deployment into an open proxy. The process involves the url.replace() function and the signer.validate() function.

Recommendations Update to version 7.8.0.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-53501

GHSA-MW3H-QJXJ-6XG9

Affected Products

Thumbor

References · 6

• https://osv.dev/vulnerability/GHSA-mw3h-qjxj-6xg9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53501 · Security Note
• https://github.com/thumbor/thumbor/security/advisories/GHSA-mw3h-qjxj-6xg9 · Note
• https://github.com/thumbor/thumbor/releases/tag/7.8.0 · Note
• https://github.com/thumbor/thumbor/commit/e3ae3e2500537b4d735df4144129a649374bb70b · Note
• https://github.com/thumbor/thumbor · Note