CVE-2026-53502 — Thumbor has path traversal via post-validation URL decoding bypass in file_loader

CVE-2026-53502

Thumbor has path traversal via post-validation URL decoding bypass in file_loader PUBLISHED

Description (CNA)

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through watermark or frame filter input. This issue is fixed in 7.8.0.

Affected (CNA)

Vendor / product	Versions
thumbor / thumbor	affected < 7.8.0

CWE

CWE-22

References

https://github.com/thumbor/thumbor/security/advisories/GHSA-cj54-hpcc-gj6h
https://github.com/thumbor/thumbor/commit/3b986d13677b30fe6651c8c72ebb25957ac0a40d
https://github.com/thumbor/thumbor/releases/tag/7.8.0

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/thumbor/thumbor/security/advisories/GHSA-cj54-hpcc-gj6h