DEBIAN-CVE-2026-53501
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation. This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths. This issue is fixed in 7.8.0.
DEBIAN-CVE-2026-53501
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-53501
thumbor
Source reference: /affected/0/package/name
- Affected versions
- 6.3.2-3
Source reference:
/affected/0/versions6.3.2-4Source reference:
/affected/0/versions6.5.1-1Source reference:
/affected/0/versions6.5.1-2Source reference:
/affected/0/versions6.5.1-3Source reference:
/affected/0/versions6.5.1-4Source reference:
/affected/0/versions6.5.1-5Source reference:
/affected/0/versions6.5.1-6Source reference:
/affected/0/versions6.5.1-7Source reference:
/affected/0/versions6.7.0-1Source reference:
/affected/0/versions7.7.7-1Source reference:
/affected/0/versions7.7.7-2Source reference:
/affected/0/versions7.7.7-3Source reference:
/affected/0/versions7.7.7-4Source reference:
/affected/0/versions7.7.7-5Source reference:
/affected/0/versions7.7.7-6Source reference:
/affected/0/versions - Fixed versions
- 7.8.0-1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.8.0-1"
}
]
}
],
"package": {
"name": "thumbor",
"purl": "pkg:deb/debian/thumbor?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"6.3.2-3",
"6.3.2-4",
"6.5.1-1",
"6.5.1-2",
"6.5.1-3",
"6.5.1-4",
"6.5.1-5",
"6.5.1-6",
"6.5.1-7",
"6.7.0-1",
"7.7.7-1",
"7.7.7-2",
"7.7.7-3",
"7.7.7-4",
"7.7.7-5",
"7.7.7-6"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-53501.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #57333 · Revision 1
- Added to Heist Feed
- Publisher date