Vulnerability in Thumbor
CVE-2026-53501
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() re…
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L.
Affected products
- Thumbor — versions < 7.8.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2026-53501?
- CVE-2026-53501 is a high-severity vulnerability in Thumbor, classified under Improper Verification of Cryptographic Signature. CVSS score: 8.2/10. Published 2026-07-31.
- How severe is CVE-2026-53501?
- High severity. CVSS v3 base score is 8.2 out of 10.