CVE-2026-53500

8.2 Élevée

Publiée le 31/07/2026 à 21:17 · Modifiée le 08/09/2026 à 22:51 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0.

Traduire en français

Produits concernés

thumbor

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.2 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L`

Faiblesses (CWE)

CWE-918

Références

https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7
https://github.com/thumbor/thumbor/releases/tag/7.8.0
https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537
https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories