CVE-2026-53502 Details

A path traversal vulnerability has been identified in Thumbor, an open-source photo thumbnail service, in versions prior to 7.8.0. The issue arises in the file_loader component, which decodes percent-encoded path segments after validating root boundaries. This flaw allows traversal outside the designated root path, enabling unauthorized access to files through the watermark or frame filter inputs. The vulnerability is exploited by sending double-encoded traversal sequences that bypass initial security checks and are later decoded to actual traversal commands, facilitating access to sensitive files such as '/etc/passwd'.

Users are advised to upgrade to Thumbor version 7.8.0 or later, where this vulnerability has been fixed.