CVE-2026-53501

Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0

Description HMAC validation can be bypassed due to the use of the Python .replace() method when removing the signature from the URL before validation. Because .replace() removes all occurrences of the substring rather than just the first one, an attacker can inject multiple copies of the signature into the URL. This results in a validated string that differs from the actual requested resource, allowing the loading of images from unintended domains or paths and potentially turning the deployment into an open proxy. The process involves the url.replace() function and the signer.validate() function.

Recommendations Update to version 7.8.0.