CVE-2026-53501 json
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
published 2026-07-31 3 mo ago modified 2026-09-08 2 mo ago also GHSA-mw3h-qjxj-6xg9 , PYSEC-2026-3620 , EUVD-2026-51608
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation. This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths. This issue is fixed in 7.8.0.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L |
| GitHub | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L |
| OSV | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | thumbor | <7.8.0 |
7.8.0 |
Affected products
- thumbor thumbor
Classification
- Weakness
-
- CWE-347 Improper Verification of Cryptographic Signature
References
-
github.com
/thumbor/thumbor/commit/e3ae3e2500537b4d735df4144129a649374bb70b
web
-
github.com
/thumbor/thumbor/security/advisories/GHSA-mw3h-qjxj-6xg9
web
-
github.com
/thumbor/thumbor/releases/tag/7.8.0
web
-
github.com
/thumbor/thumbor
package
-
pypi.org
/project/thumbor
package
-
github.com
/advisories/GHSA-mw3h-qjxj-6xg9
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-53501
advisory
Sources
- CVE List CVE-2026-53501
- GitHub Advisory GHSA-mw3h-qjxj-6xg9
- NVD CVE-2026-53501
- OSV PYSEC-2026-3620
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.