Skip to content
Threat Feed
Subscribe

Product

Thumbor (<= 7.7.7)

1 brief RSS
high advisory

Thumbor Path Traversal via URL Decoding Bypass

Thumbor version 7.7.7 and earlier is vulnerable to arbitrary file read via a path traversal flaw in file_loader.py, where security checks are performed before decoding percent-encoded traversal sequences.

Thumbor web-application-vulnerability hmac-bypass image-processing cve-2026-53501 ssrf web-application input-validation
1r 2t 1c 1i