CVE-2026-53502: Thumbor Path Traversal Vulnerability

CVE-2026-53502 Overview

CVE-2026-53502 is a path traversal vulnerability in Thumbor, an open-source photo thumbnail service maintained by globo.com. The flaw resides in the file_loader module, which decodes percent-encoded path segments after performing its root-boundary validation. Attackers can supply encoded traversal sequences such as %2e%2e/ through watermark or frame filter inputs to escape the FILE_LOADER_ROOT_PATH directory. Successful exploitation allows unauthenticated attackers to read files outside the intended root, exposing sensitive host content. The issue is fixed in Thumbor 7.8.0.

Critical Impact
Unauthenticated remote attackers can read arbitrary files outside the configured Thumbor loader root by supplying percent-encoded traversal sequences through watermark or frame filter parameters.

Affected Products

Thumbor versions prior to 7.8.0
Deployments using the file_loader with FILE_LOADER_ROOT_PATH
Instances exposing watermark or frame filter functionality

Discovery Timeline

2026-07-31 - CVE-2026-53502 published to the National Vulnerability Database (NVD)
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-53502

Vulnerability Analysis

Thumbor's file_loader loads images from a filesystem root defined by FILE_LOADER_ROOT_PATH. Before the fix, the loader validated the resolved path against the root using abspath and startswith before decoding percent-encoded characters. Attackers can supply sequences like %2e%2e%2f that pass the boundary check while still encoded. The loader later decodes these sequences via unquote, transforming them into literal ../ components that traverse outside the root. The flaw is reachable through image URL paths and, notably, through the watermark and frame filter arguments that accept image references. This is classified as a path traversal weakness [CWE-22].

Root Cause

The root cause is ordering: the security check occurs on the encoded path, and decoding happens afterward. Any check-then-decode sequence permits encoded traversal payloads to bypass validation. The pre-patch code executed abspath(join(root, path)) and checked startswith(root) on data that still contained %2e%2e sequences, making the guard ineffective against encoded traversal.

Attack Vector

An unauthenticated attacker crafts a Thumbor request whose watermark or frame filter references a percent-encoded traversal path. The request reaches the network-exposed Thumbor endpoint with no privileges or user interaction required. Thumbor validates the encoded string, decodes it, and reads the target file from the host filesystem, returning its contents to the attacker.

python

# Patch: thumbor/loaders/file_loader.py
# Source: https://github.com/thumbor/thumbor/commit/3b986d13677b30fe6651c8c72ebb25957ac0a40d

from datetime import datetime
from os import fstat
-from os.path import abspath, exists, isfile, join
+from os.path import abspath, commonpath, exists, isfile, join
from urllib.parse import unquote

from thumbor.loaders import LoaderResult


+def _inside_root_path(root, path):
+    try:
+        return commonpath([root, path]) == root
+    except ValueError:
+        return False
+
+
async def load(context, path):
-    file_path = join(
-        context.config.FILE_LOADER_ROOT_PATH.rstrip("/"), path.lstrip("/")
-    )
-    file_path = abspath(file_path)
-    inside_root_path = file_path.startswith(
-        abspath(context.config.FILE_LOADER_ROOT_PATH)
-    )
+    root = abspath(context.config.FILE_LOADER_ROOT_PATH)
+
+    # Decode percent-encoding BEFORE the security check. Checking the
+    # encoded path would allow sequences like %2e%2e to pass the
+    # abspath/startswith guard and later be decoded into real traversal

The fix decodes the path before validation and uses commonpath to compare the resolved file path against the root, ensuring encoded traversal cannot bypass the boundary check.

Detection Methods for CVE-2026-53502

Indicators of Compromise

Thumbor access logs containing percent-encoded traversal patterns such as %2e%2e%2f, %2E%2E/, or ..%2f in URL paths or filter arguments
Requests to watermark(...) or frame(...) filters referencing encoded absolute paths like %2Fetc%2Fpasswd
Successful 200 responses for filter-based requests returning non-image content types or unexpected file sizes

Detection Strategies

Inspect web server and reverse proxy logs for encoded traversal sequences inside Thumbor URL segments, especially within watermark and frame filter parameters
Deploy WAF rules that normalize percent-encoding before matching against traversal patterns to catch double-encoded and mixed-case variants
Monitor filesystem access from the Thumbor process for reads outside FILE_LOADER_ROOT_PATH

Monitoring Recommendations

Alert on Thumbor processes opening files outside the configured loader root directory
Track spikes in filter-based requests, particularly watermark and frame, that reference external paths or return non-image MIME types
Correlate Thumbor request logs with process-level file access telemetry to identify successful traversal reads

How to Mitigate CVE-2026-53502

Immediate Actions Required

Upgrade Thumbor to version 7.8.0 or later, which decodes paths before enforcing the root boundary
Audit FILE_LOADER_ROOT_PATH contents and ensure no sensitive files reside within or adjacent to the loader root
Review Thumbor request logs for prior exploitation attempts containing encoded traversal sequences

Patch Information

The fix is available in Thumbor 7.8.0. See the GitHub Security Advisory GHSA-cj54-hpcc-gj6h, the GitHub Release 7.8.0, and the remediation commit. The patch introduces _inside_root_path using commonpath and decodes percent-encoding before the boundary check.

Workarounds

Place Thumbor behind a reverse proxy or WAF that rejects requests containing percent-encoded traversal sequences (%2e%2e, %2f, %5c) in URL paths and filter arguments
Restrict the file_loader root to a dedicated directory containing only image assets, with no sensitive files reachable via ../ from that directory
Run the Thumbor process under a low-privilege user account with filesystem access limited to the intended asset directory

bash

# Upgrade Thumbor to the patched release
pip install --upgrade 'thumbor>=7.8.0'

# Verify installed version
python -c "import thumbor; print(thumbor.__version__)"

# Example: restrict FILE_LOADER_ROOT_PATH in thumbor.conf
# FILE_LOADER_ROOT_PATH = '/var/thumbor/images'