CVE-2026-53502: Thumbor has path traversal via post-validation URL decoding bypass in file_loader

July 31, 2026

The file_loader performs unquote() on the file path AFTER the abspath() + startswith() security check. An attacker can use percent-encoded path traversal sequences (%2e%2e for ..) that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences.

References

github.com/advisories/GHSA-cj54-hpcc-gj6h
github.com/thumbor/thumbor/commit/3b986d13677b30fe6651c8c72ebb25957ac0a40d
github.com/thumbor/thumbor/releases/tag/7.8.0
github.com/thumbor/thumbor/security/advisories/GHSA-cj54-hpcc-gj6h
nvd.nist.gov/vuln/detail/CVE-2026-53502

Code Behaviors & Features

Detect and mitigate CVE-2026-53502 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →