CVE-2026-53500

HIGH 8.2

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

CVSS Score

8.2

EPSS Score

0.0%

EPSS Percentile

0th

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0.

CWE	CWE-918
Vendor	thumbor
Product	thumbor
Published	Jul 31, 2026

Stay Ahead of the Next One

Get instant alerts for thumbor thumbor

Be the first to know when new high vulnerabilities affecting thumbor thumbor are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Affected Versions

thumbor / thumbor

< 7.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537 github.com: https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7 github.com: https://github.com/thumbor/thumbor/releases/tag/7.8.0