PT-2026-66840 · Thumbor · Thumbor

CVE-2026-53503 · Published 2026-07-31 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0

Description A remote denial of service exists in the filters:convolution(<matrix>, <columns>, <should normalize>) filter. The filter passes the user-controlled columns variable to a C extension (thumbor/ext/filters/ convolution.c) where it is used as a divisor for modulo and division operations without validating that the value is greater than zero. When columns is set to 0, it triggers undefined behavior, which on x86 64 architectures results in a fatal divide-by-zero trap (SIGFPE), crashing the Thumbor process. This can be exploited via /unsafe/ URLs if enabled, or through signed URLs.

Recommendations Update to version 7.8.0. As a temporary workaround, restrict access to the filters:convolution() filter or disable the use of /unsafe/ URLs to minimize the risk of exploitation.

Exploit

Fix

Divide By Zero

RCE

Weakness Enumeration

CWE-369

CWE-20

Related Identifiers

CVE-2026-53503

GHSA-CQJP-JF4R-H5Q9

Affected Products

Thumbor

References · 6

• 🔥 https://github.com/thumbor/thumbor/security/advisories/GHSA-cqjp-jf4r-h5q9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-53503 · Security Note
• https://osv.dev/vulnerability/GHSA-cqjp-jf4r-h5q9 · Vendor Advisory
• https://github.com/thumbor/thumbor/releases/tag/7.8.0 · Note
• https://github.com/thumbor/thumbor/commit/447e192e3fb92e64c12e5354a56a4a7133f69d73 · Note
• https://github.com/thumbor/thumbor · Note