Thumbor CVE-2026-53501

Exploitation requires Thumbor to be running with a configured SECURITY_KEY (signed URL mode enabled) and with 'unsafe' mode disabled - this is the recommended production configuration and therefore the primary deployment target. The attacker must possess at least one valid HMAC-SHA1 signature for any URL served by the target Thumbor instance, obtainable by passively observing any signed image URL in use (e.g., from a web page's <img> tags). No authentication to Thumbor is required (CVSS PR:N). Thumbor instances running in 'unsafe' mode lack HMAC protection entirely and are out of scope for this bypass but are separately misconfigured. Exploitation is platform-independent and affects all OS environments running pip/thumbor ≤ 7.7.7. The dual .replace() for both plain and URL-encoded hash forms means both = and %3D variants of the signature can be leveraged, offering two manipulation vectors.

The NVD-assigned CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) is consistent with the described vulnerability and independently corroborated by this analysis. Exploitation requires no authentication (PR:N) because the attacker only needs to observe one legitimately signed Thumbor URL - obtainable from any page serving Thumbor images. Attack complexity is genuinely low (AC:L): constructing the injection is mechanical once a valid signature is known. The integrity impact is high because the entire signed URL trust model is defeated, permitting Thumbor to be abused as an open proxy for arbitrary image sources. No EPSS score or KEV listing is present in the provided intelligence, and no POC repository was referenced; however, the fix commit includes explicit regression tests that demonstrate the attack technique, effectively serving as a weaponizable proof-of-concept blueprint. The 'RCE' tag in the source data is a misclassification - nothing in the description or fix supports remote code execution; impact is limited to signature bypass and unauthorized resource fetching.

An attacker browses a public web page that serves Thumbor-processed images and records a legitimately signed URL such as /ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/v1/image.jpg. The attacker constructs a crafted URL by splitting the target unauthorized path (e.g., pointing at an attacker-controlled domain) and inserting copies of the extracted HMAC signature at the split points. When Thumbor processes this request, the global str.replace() strips all signature occurrences, leaving a URL that matches the original signed resource for validation purposes but routes the actual fetch to the unauthorized host.