CVE-2026-53500: Thumbor Information Disclosure Flaw

CVE-2026-53500 Overview

CVE-2026-53500 is a Server-Side Request Forgery (SSRF) vulnerability in Thumbor, an open-source photo thumbnail service maintained by globo.com. Versions prior to 7.8.0 pass plain string entries in the ALLOWED_SOURCES configuration directly to Python's re.match() without escaping regex metacharacters. Dots in hostnames are interpreted as regex wildcards rather than literal characters. An attacker can craft a hostname that differs at dot positions but still satisfies the allowlist regex. The flaw is tracked as CWE-918: Server-Side Request Forgery and is fixed in Thumbor 7.8.0.

Critical Impact
Unauthenticated remote attackers can bypass hostname allowlists to force Thumbor into fetching arbitrary URLs, enabling SSRF against internal services.

Affected Products

Thumbor versions prior to 7.8.0
Deployments using the HttpLoader with plain string entries in ALLOWED_SOURCES
globo.com Thumbor open-source photo thumbnail service

Discovery Timeline

2026-07-31 - CVE-2026-53500 published to the National Vulnerability Database
2026-08-01 - CVE-2026-53500 last updated in NVD

Technical Details for CVE-2026-53500

Vulnerability Analysis

Thumbor's HttpLoader restricts outbound image fetches using the ALLOWED_SOURCES configuration. Prior to 7.8.0, entries were treated as regular expressions and evaluated with re.match(). Plain string values such as s.glbimg.com were passed unescaped, causing the dot characters to match any single character.

An attacker registers a lookalike hostname that satisfies the resulting regex. For example, an entry intended to allow s.glbimg.com also matches sXglbimgYcom when combined with a controlled domain suffix. The HttpLoader then fetches attacker-supplied URLs while appearing to honor the allowlist.

The network-reachable nature of the flaw and lack of authentication requirements make it exploitable by any client capable of issuing a Thumbor image transformation request.

Root Cause

The root cause is a failure to escape regex metacharacters in user-supplied allowlist entries. re.match() treats . as a wildcard matching any character except newline. Because the loader accepted plain strings but applied regex semantics, the effective allowlist was broader than administrators intended. Backward compatibility with legacy regex patterns compounded the ambiguity.

Attack Vector

Exploitation occurs over the network by sending a crafted image URL to the Thumbor service. The attacker controls a hostname whose characters align with dot positions in an allowlist entry. Thumbor issues an HTTP request to the attacker-controlled or internal target, returning response data through the thumbnail pipeline. This enables SSRF against internal metadata services, cloud provider endpoints, or non-public HTTP resources.

python

# Security patch in thumbor/config.py
# Source: https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7
Config.define(
    "ALLOWED_SOURCES",
    [],
    (
        "Allowed sources for the HTTP loader. Each entry is matched against the "
        "request hostname. Plain strings are matched literally (dots are NOT "
        "wildcards). Regex-like strings are accepted only for backward "
        "compatibility and log a warning; use compiled patterns for new "
        "regular expressions: "
        "re.compile(r'.*\\.mydomain\\.com'). Example: "
        "ALLOWED_SOURCES = ['images.mydomain.com', re.compile(r'cdn[0-9]+\\.example\\.com')]"
    ),
    "Imaging",
)

The patch changes ALLOWED_SOURCES semantics so plain strings are matched literally against the request hostname. Regex behavior now requires explicit re.compile() objects, eliminating implicit wildcard interpretation of dots.

Detection Methods for CVE-2026-53500

Indicators of Compromise

Outbound HTTP requests from Thumbor hosts to domains that visually resemble allowlisted domains but differ at dot positions (for example, sXglbimgYcom).
Thumbor HttpLoader fetches targeting RFC1918 addresses, 169.254.169.254, or other internal endpoints.
Unexpected image transformation requests containing encoded internal URLs in the source parameter.

Detection Strategies

Parse Thumbor access logs for image source URLs whose hostnames do not exactly equal any intended allowlisted domain.
Correlate Thumbor egress traffic with the configured ALLOWED_SOURCES list and alert on hostname mismatches at character positions where dots appear.
Deploy web application firewall (WAF) rules that reject Thumbor requests referencing internal IP ranges or cloud metadata hostnames.

Monitoring Recommendations

Enable verbose logging in the Thumbor HttpLoader and forward events to a centralized SIEM for hostname allowlist auditing.
Monitor egress from Thumbor service accounts and alert on connections to non-image infrastructure such as internal APIs.
Track the running Thumbor version across deployments and flag any host below 7.8.0.

How to Mitigate CVE-2026-53500

Immediate Actions Required

Upgrade Thumbor to version 7.8.0 or later on all HttpLoader-enabled deployments.
Audit existing ALLOWED_SOURCES entries and rewrite them as literal hostnames or explicit re.compile() patterns with escaped dots.
Restrict Thumbor egress at the network layer to only the hostnames or CIDR ranges that host legitimate image origins.

Patch Information

The fix is delivered in Thumbor Release 7.8.0. The patch is described in the GitHub Security Advisory GHSA-6x26-6r6f-m537 and implemented in commit 6887671. Plain string entries are now matched literally, while regex behavior requires compiled patterns.

Workarounds

Replace all plain-string entries in ALLOWED_SOURCES with re.compile() objects containing escaped dots, for example re.compile(r'https?://[^/]+\.globo\.com/.*').
Place Thumbor behind an egress proxy that enforces a strict hostname allowlist independent of the application configuration.
Block Thumbor from reaching internal address spaces including RFC1918, link-local, and cloud metadata endpoints.

bash

# Post-patch ALLOWED_SOURCES example using compiled regex patterns
# Source: https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7
import re

ALLOWED_SOURCES = [
    's.glbimg.com',
    re.compile(r'https?://[^/]+\.globo\.com/.*'),
    re.compile(r'https?://[^/]+\.glbimg\.com/.*'),
]