Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-53502

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through watermark or frame filter input. This issue is fixed in 7.8.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

thumbor thumbor

  • < 7.8.0affected

References