Tthumbor

Products

Exploited and recent CVEs

• CVE-2026-53502 High 8.7 Thumbor has path traversal via post-validation URL decoding bypass in file_loader 0.5%
• CVE-2026-53505 High 7.5 Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS 0.6%
• CVE-2026-53504 High 7.5 Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter 0.6%
• CVE-2026-53503 High 7.5 Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS 0.8%
• CVE-2026-53501 High 8.2 Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature 0.4%
• CVE-2026-53500 High 8.2 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot 0.5%