CVE-2026-53500 Details
Description
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0.
A vulnerability exists in Thumbor, an open-source photo thumbnail service, in versions prior to 7.8.0. The issue arises in the ALLOWED_SOURCES configuration, where plain string entries are passed to re.match() without proper escaping of dots. This oversight allows for hostname bypasses, as a string like 's.glbimg.com' could unintentionally match 'sXglbimgYcom' or 'sAglbimg.com', undermining the intended source restrictions. The vulnerability is particularly concerning because it can be exploited to fetch images from arbitrary hosts, bypassing the ALLOWED_SOURCES allowlist, which is meant to prevent server-side request forgery (SSRF) attacks.
Users are advised to upgrade to Thumbor version 7.8.0 or later, where this vulnerability has been fixed. The ALLOWED_SOURCES configuration now properly escapes dots, preventing the described bypass. For more details on the update, refer to the Thumbor release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 31, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7 | [email protected] | Source CodeVendor |
| https://github.com/thumbor/thumbor/releases/tag/7.8.0 | [email protected] | Release NotesVendor |
| https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Thumbor | <= 7.7.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 1, 2026 | CVE Modified | CISA-ADP |
| Jul 31, 2026 | New CVE Received | [email protected] |