Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

thumbor — Vulnerabilities & Security Advisories 6

All 6 CVE vulnerabilities found in thumbor, with AI-generated Chinese analysis, references, and POCs.

Vendor: thumbor

CVE IDTitleCVSSSeverityPublished
CVE-2026-53502 Thumbor has path traversal via post-validation URL decoding bypass in file_loader CWE-22 8.7 High2026-07-31
CVE-2026-53505 Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS CWE-400 7.5 High2026-07-31
CVE-2026-53504 Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter CWE-400 7.5 High2026-07-31
CVE-2026-53503 Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS CWE-20 7.5 High2026-07-31
CVE-2026-53501 Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature CWE-347 8.2 High2026-07-31
CVE-2026-53500 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot CWE-918 8.2 High2026-07-31

All 6 known CVE vulnerabilities affecting thumbor with full Chinese analysis, references, and POCs where available.