Vulnerability Description
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through watermark or frame filter input. This issue is fixed in 7.8.0.
Related Weaknesses (CWE)
References
- https://github.com/thumbor/thumbor/commit/3b986d13677b30fe6651c8c72ebb25957ac0a4
- https://github.com/thumbor/thumbor/releases/tag/7.8.0
- https://github.com/thumbor/thumbor/security/advisories/GHSA-cj54-hpcc-gj6h
- https://github.com/thumbor/thumbor/security/advisories/GHSA-cj54-hpcc-gj6h
FAQ
What is CVE-2026-53502?
CVE-2026-53502 is a documented vulnerability. Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LO...
How severe is CVE-2026-53502?
CVSS scoring is not yet available for CVE-2026-53502. Check NVD for updates.
Is there a patch for CVE-2026-53502?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.