CVE-2026-53501

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation. This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths. This issue is fixed in 7.8.0.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/thumbor/thumbor/commit/e3ae3e2500537b4d735df4144129a649374bb70b
https://github.com/thumbor/thumbor/releases/tag/7.8.0
https://github.com/thumbor/thumbor/security/advisories/GHSA-mw3h-qjxj-6xg9

Configurations

No configuration.

History

No history.

Information

Published : 2026-07-31 19:17

Updated : 2026-09-08 20:51

NVD link : CVE-2026-53501

Mitre link : CVE-2026-53501

CVE.ORG link : CVE-2026-53501

JSON object : View

Products Affected

No product.

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2026-53501", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53501", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T19:57:48.500225Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "thumbor", "product": "thumbor", "versions": [{"status": "affected", "version": "< 7.8.0"}]}]}], "published": "2026-07-31T19:17:09.413", "references": [{"url": "https://github.com/thumbor/thumbor/commit/e3ae3e2500537b4d735df4144129a649374bb70b", "source": "security-advisories@github.com"}, {"url": "https://github.com/thumbor/thumbor/releases/tag/7.8.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-mw3h-qjxj-6xg9", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor\u2019s HMAC validation can be bypassed due to the use of Python\u2019s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation. This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths. This issue is fixed in 7.8.0."}], "lastModified": "2026-09-08T20:51:43.490", "sourceIdentifier": "security-advisories@github.com"}