{
  "affected": [
    {
      "affectedData": [
        {
          "product": "thumbor",
          "vendor": "thumbor",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.8.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0."
    }
  ],
  "id": "CVE-2026-53500",
  "lastModified": "2026-09-08T20:51:43.490",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53500",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-31T23:29:34.062473Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-31T19:17:09.247",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/thumbor/thumbor/releases/tag/7.8.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.7.7"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "thumbor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53500"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T18:36:03Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `ALLOWED_SOURCES` configuration is meant to restrict which hosts Thumbor\u0027s HTTP loader may fetch images from. Plain-string entries in that list (the overwhelming majority of real-world and documented configurations) are passed directly to `re.match()` without escaping. Because `.` is a regex wildcard, every dot in a domain name becomes a bypass vector: `s.glbimg.com` silently matches `sXglbimgYcom`, `sAglbimg.com`, and any other hostname that differs only at a dot position. This undermines the primary SSRF defence that `ALLOWED_SOURCES` is intended to provide.\n\n## Affected component\n\n`thumbor/loaders/http_loader.py` \u2014 `validate()`\n\n## Proof of concept\n\n```python\nimport re\nfrom thumbor.config import Config\nfrom thumbor.context import Context\nfrom thumbor.loaders import http_loader as loader\n\nconfig = Config()\nconfig.ALLOWED_SOURCES = [\"s.glbimg.com\"]   # typical user config\nctx = Context(None, config, None)\n\n# These should be blocked \u2014 both return True due to the unescaped dot\nprint(loader.validate(ctx, \"http://sXglbimgYcom/secret.jpg\"))  # True \u2190 bypass\nprint(loader.validate(ctx, \"http://sAglbimg.com/secret.jpg\"))  # True \u2190 bypass\n\n# Legitimate origin \u2014 correctly allowed\nprint(loader.validate(ctx, \"http://s.glbimg.com/logo.jpg\"))    # True \u2190 correct\n```\n\n## Root cause\n\n`thumbor/loaders/http_loader.py` (before fix):\n\n```python\nfor pattern in context.config.ALLOWED_SOURCES:\n    if isinstance(pattern, Pattern):\n        match = url\n    else:\n        pattern = f\"^{pattern}$\"   # \u003c-- dots not escaped, act as regex wildcard\n        match = res.hostname\n\n    if re.match(pattern, match):\n        return True\n```\n\n## Impact\n\nAn attacker who can influence the image source URL passed to Thumbor can fetch images from arbitrary hosts, bypassing the `ALLOWED_SOURCES` allowlist.\n\n**Preconditions:**\n\n- `ALLOWED_SOURCES` contains at least one plain-string entry (the common case; all official documentation examples use plain strings).\n- The attacker can supply or influence the image URL \u2014 true whenever  `ALLOW_UNSAFE_URL = True` (the default), or when the application forwards user input to a signed URL endpoint.\n\n## Fix\n\nApply `re.escape()` to plain-string patterns before compiling them, so every\ncharacter is matched literally:\n\n```python\nelse:\n    pattern = f\"^{re.escape(pattern)}$\"   # dots and other metacharacters are now literal\n    match = res.hostname\n```\n\nThis is a one-call addition with no breaking change for correctly written configurations. Users who need real regular-expression behaviour should supply a compiled pattern (`re.compile(r\"s\\.glbimg\\.com\")`), which is already handled by the existing `isinstance(pattern, Pattern)` branch and is unaffected by this change.\n\nThe `ALLOWED_SOURCES` docstring in `config.py` was also updated to document the two-mode behaviour explicitly.",
  "id": "GHSA-6x26-6r6f-m537",
  "modified": "2026-07-31T18:36:03Z",
  "published": "2026-07-31T18:36:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/thumbor/thumbor"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thumbor/thumbor/releases/tag/7.8.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "thumbor",
        "purl": "pkg:pypi/thumbor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.1.3",
        "4.10.0",
        "4.10.1",
        "4.10.2",
        "4.10.3",
        "4.11.0",
        "4.11.1",
        "4.12.0",
        "4.12.1",
        "4.12.2",
        "4.4.1",
        "4.5.3",
        "4.5.4",
        "4.6.0",
        "4.7.0",
        "4.7.1",
        "4.8.0",
        "4.8.1",
        "4.8.2",
        "4.8.3",
        "4.8.4",
        "4.8.5",
        "4.8.6",
        "4.9.0",
        "4.9.1",
        "5.0.0",
        "5.0.0rc1",
        "5.0.0rc2",
        "5.0.1",
        "5.0.2",
        "5.0.3",
        "5.0.4",
        "5.0.5",
        "5.0.6",
        "5.1.0",
        "5.2.0",
        "5.2.1",
        "6.0.0",
        "6.0.0b1",
        "6.0.0b2",
        "6.0.0b3",
        "6.0.0b4",
        "6.0.0b5",
        "6.0.1",
        "6.0.2",
        "6.1.0",
        "6.1.1",
        "6.1.2",
        "6.1.3",
        "6.1.4",
        "6.1.5",
        "6.2.0",
        "6.2.1",
        "6.3.0",
        "6.3.1",
        "6.3.2",
        "6.4.0",
        "6.4.1",
        "6.4.2",
        "6.4.3",
        "6.5.0",
        "6.5.1",
        "6.5.2",
        "6.6.0",
        "6.6.1",
        "6.7.0",
        "6.7.1",
        "6.7.2",
        "6.7.3",
        "6.7.4",
        "6.7.5",
        "6.7.6",
        "7.0.0",
        "7.0.0a1",
        "7.0.0a2",
        "7.0.0a3",
        "7.0.0a4",
        "7.0.0a5",
        "7.0.0b1",
        "7.0.1",
        "7.0.10",
        "7.0.11",
        "7.0.12",
        "7.0.2",
        "7.0.3",
        "7.0.5",
        "7.0.6",
        "7.0.7",
        "7.0.8",
        "7.0.9",
        "7.1.0",
        "7.1.1",
        "7.1.2",
        "7.2.0",
        "7.2.1",
        "7.3.0",
        "7.3.1",
        "7.3.2",
        "7.4.0",
        "7.4.1",
        "7.4.2",
        "7.4.3",
        "7.4.4",
        "7.4.5",
        "7.4.6",
        "7.4.7",
        "7.5.0",
        "7.5.1",
        "7.5.2",
        "7.6.0",
        "7.7.0",
        "7.7.1",
        "7.7.2",
        "7.7.3",
        "7.7.4",
        "7.7.5",
        "7.7.6",
        "7.7.7"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53500",
    "GHSA-6x26-6r6f-m537"
  ],
  "details": "## Summary\n\nThe `ALLOWED_SOURCES` configuration is meant to restrict which hosts Thumbor\u0027s HTTP loader may fetch images from. Plain-string entries in that list (the overwhelming majority of real-world and documented configurations) are passed directly to `re.match()` without escaping. Because `.` is a regex wildcard, every dot in a domain name becomes a bypass vector: `s.glbimg.com` silently matches `sXglbimgYcom`, `sAglbimg.com`, and any other hostname that differs only at a dot position. This undermines the primary SSRF defence that `ALLOWED_SOURCES` is intended to provide.\n\n## Affected component\n\n`thumbor/loaders/http_loader.py` \u2014 `validate()`\n\n## Proof of concept\n\n```python\nimport re\nfrom thumbor.config import Config\nfrom thumbor.context import Context\nfrom thumbor.loaders import http_loader as loader\n\nconfig = Config()\nconfig.ALLOWED_SOURCES = [\"s.glbimg.com\"]   # typical user config\nctx = Context(None, config, None)\n\n# These should be blocked \u2014 both return True due to the unescaped dot\nprint(loader.validate(ctx, \"http://sXglbimgYcom/secret.jpg\"))  # True \u2190 bypass\nprint(loader.validate(ctx, \"http://sAglbimg.com/secret.jpg\"))  # True \u2190 bypass\n\n# Legitimate origin \u2014 correctly allowed\nprint(loader.validate(ctx, \"http://s.glbimg.com/logo.jpg\"))    # True \u2190 correct\n```\n\n## Root cause\n\n`thumbor/loaders/http_loader.py` (before fix):\n\n```python\nfor pattern in context.config.ALLOWED_SOURCES:\n    if isinstance(pattern, Pattern):\n        match = url\n    else:\n        pattern = f\"^{pattern}$\"   # \u003c-- dots not escaped, act as regex wildcard\n        match = res.hostname\n\n    if re.match(pattern, match):\n        return True\n```\n\n## Impact\n\nAn attacker who can influence the image source URL passed to Thumbor can fetch images from arbitrary hosts, bypassing the `ALLOWED_SOURCES` allowlist.\n\n**Preconditions:**\n\n- `ALLOWED_SOURCES` contains at least one plain-string entry (the common case; all official documentation examples use plain strings).\n- The attacker can supply or influence the image URL \u2014 true whenever  `ALLOW_UNSAFE_URL = True` (the default), or when the application forwards user input to a signed URL endpoint.\n\n## Fix\n\nApply `re.escape()` to plain-string patterns before compiling them, so every\ncharacter is matched literally:\n\n```python\nelse:\n    pattern = f\"^{re.escape(pattern)}$\"   # dots and other metacharacters are now literal\n    match = res.hostname\n```\n\nThis is a one-call addition with no breaking change for correctly written configurations. Users who need real regular-expression behaviour should supply a compiled pattern (`re.compile(r\"s\\.glbimg\\.com\")`), which is already handled by the existing `isinstance(pattern, Pattern)` branch and is unaffected by this change.\n\nThe `ALLOWED_SOURCES` docstring in `config.py` was also updated to document the two-mode behaviour explicitly.",
  "id": "PYSEC-2026-3617",
  "modified": "2026-08-04T13:36:37.987077Z",
  "published": "2026-08-04T11:34:46.220271Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/thumbor/thumbor"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thumbor/thumbor/releases/tag/7.8.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/thumbor"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-6x26-6r6f-m537"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53500"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot"
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "thumbor",
            "binary_version": "7.7.7-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "thumbor",
        "purl": "pkg:deb/ubuntu/thumbor@7.7.7-5?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.7.7-4",
        "7.7.7-5"
      ]
    }
  ],
  "aliases": [],
  "details": "Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0.",
  "id": "UBUNTU-CVE-2026-53500",
  "modified": "2026-08-06T00:20:53Z",
  "published": "2026-07-31T19:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-53500"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53500"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/thumbor/thumbor/releases/tag/7.8.0"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-53500"
  ]
}