CVE-2026-53501: Thumbor HMAC validation bypass via multiple signature injection

CVE-2026-53501 · Severity: high · CVSS 8.2 · Published 2026-07-31

Thumbor, an open-source photo processing service, contains a security flaw in how it verifies signed web addresses. By including the security signature multiple times within a single request, an attacker can trick the system into validating a different destination than the one actually being requested. This allows unauthorized users to bypass security restrictions, potentially using the service to fetch images from unintended domains or bypass access controls.

Technologies: thumbor (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-53501 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53501 being exploited in the wild.
How severe is CVE-2026-53501?
High severity, with a CVSS score of 8.2, published 31 July 2026.
Which products and versions are affected?
thumbor (PyPI) <= 7.7.7, ECOSYSTEM:introduced=0,fixed=7.8.0.
Is there a fix for CVE-2026-53501?
Yes. thumbor (PyPI): upgrade to 7.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53501 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53501?
Check whether you run thumbor (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • thumbor (PyPI): upgrade to 7.8.0 or later
    pip install "thumbor>=7.8.0"

Technical details

A signature bypass vulnerability exists in Thumbor's HMAC validation logic due to the improper use of Python's `str.replace()` method. When validating a request, Thumbor attempts to strip the HMAC signature from the URL to reconstruct the original string for verification; however, because `replace()` removes all occurrences of the substring, an attacker can inject the valid signature multiple times into the URL path. This causes the validation routine to strip the injected signatures as well, resulting in a 'validated' URL that differs from the actual requested resource path. This allows for path manipulation and the loading of images from unauthorized domains. The issue is resolved in version 7.8.0 by switching to a prefix-based strip mechanism.

Affected products

  • thumbor thumbor < 7.8.0

Identifiers

  • CVE-2026-53501
  • GHSA-mw3h-qjxj-6xg9
  • PYSEC-2026-3620

Timeline

  • 2026-05-30: patched: Version 7.8.0 released
  • 2026-06-10: advisory: GitHub Security Advisory published
  • 2026-07-31: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.