Thumbor CVE-2026-53502

Thumbor (pip package thumbor) is a Python-based open-source image processing and thumbnailing service. The vulnerable component is thumbor/loaders/file_loader.py, which handles loading source images from the local filesystem. The CWE-22 (Path Traversal) root cause is a classic TOCTOU-style validation ordering error: the security check (abspath()+startswith()) operated on the raw, still-encoded path string. Because Python's os.path.abspath() does not decode percent-encoded characters, %2e%2e is treated as a literal two-character directory name, so the root-boundary check passes. The subsequent urllib.parse.unquote() call - intended for backwards compatibility with filenames containing literal percent-encoded characters - then converts %2e%2e into .. before the path is used for file I/O. The watermark and frame filters are particularly exploitable because, unlike the main image URL flow (which applies quote() in imaging.py), they pass their URL parameters directly to file_loader without re-encoding. Double-encoding (%252e → Tornado HTTP layer decodes to %2e → file_loader unquote decodes to .) enables bypass through the Tornado web server's own decoding stage as well. The fix (commit 3b986d1) moves unquote() to execute before the security check and replaces startswith() with os.path.commonpath() to prevent sibling-directory bypass attacks.