PT-2026-66839 · Thumbor · Thumbor
CVE-2026-53502
·
Published
2026-07-31
·
Updated
2026-07-31
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Thumbor versions prior to 7.8.0
Description
An issue exists in the
file loader where percent-encoded path segments are decoded after the root-boundary validation. This occurs because the unquote() function is applied to the file path after the abspath() and startswith() security checks. An attacker can use percent-encoded path traversal sequences, such as %2e%2e for .., which are initially treated as literal directory names to bypass security checks but are subsequently decoded into actual traversal sequences. This behavior is exploitable through the watermark or frame filter input, as these filters pass URL parameters directly to the loader without re-encoding. This can lead to arbitrary file read on the server, allowing access to configuration files, secrets, or private keys if the file is in a valid image format.Recommendations
Update to version 7.8.0.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Thumbor