Listen to this Post
How CVE-2026-53501 Works
Thumbor is an open-source photo thumbnail service that uses HMAC-SHA1 to sign URLs, preventing unauthorized loading of external images or filter invocation. During request validation, Thumbor removes the signature from the URL before recalculating the HMAC. The vulnerable code performs this removal using Python’s `.replace()` method.
The critical flaw is that `.replace()` removes all occurrences of a substring, not just the first one. Since the signature is part of the URL path, an attacker can inject additional copies of the same signature elsewhere in the URL.
When Thumbor processes such a crafted request, `.replace()` strips out every instance of the signature substring. The resulting `url_to_validate` used for HMAC verification becomes different from the actual request path that Thumbor will fetch. A second `.replace()` call targeting the URL-encoded version of the signature (%3D) allows even more precise path manipulation.
This discrepancy between the validated URL and the effective request path allows an attacker to bypass HMAC entirely and load images from arbitrary external domains or restricted internal paths.
DailyCVE Form
Platform: Thumbor
Version: < 7.8.0
Vulnerability: HMAC Validation Bypass
Severity: High (CVSS 8.2)
Date: 2026-07-31
Prediction: 2026-08-07
What Undercode Say:
Check current Thumbor version pip show thumbor | grep Version List all installed Thumbor versions pip list --all | grep thumbor Verify if vulnerable version is in use (< 7.8.0) python -c "import thumbor; print(thumbor.<strong>version</strong>)"
Vulnerable Code Snippet (Thumbor < 7.8.0):
url_to_validate = url.replace(
f"/{self.context.request.hash}/", ""
).replace(f"/{quoted_hash}/", "")
Crafted Attack URL Example:
/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.co/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/m/v1/.../image.jpg
After `.replace()` removes all hash occurrences, the validated URL becomes:
/300x200/s3.glbimg.co/m/v1/.../image.jpg
URL-Encoded Hash Manipulation Example:
/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/ddoyYVYUbDf6Po/ddoyYVYUbDf6Po_dzOrBhCDrXLc%3D/ddoyYVYUbDf6Po/v1/...
Exploit:
- Obtain a valid signed Thumbor URL with its HMAC signature.
- Inject additional copies of the signature string into the URL path (before the image domain or within the path).
- Optionally use the URL-encoded version (
%3D) for finer path control. - Submit the crafted URL to the Thumbor server.
- The server removes all signature occurrences, validates a different URL, then fetches the attacker-specified resource.
Protection:
1. Upgrade to Thumbor version 7.8.0 or later.
- Apply the patch that limits replacement to the first occurrence only:
url.replace(f"/{self.context.request.hash}/", "", 1) - Reconstruct the unsigned URL deterministically from parsed request components instead of using string replacement.
- Implement network-level monitoring for abnormal URL patterns with repeated signature strings.
Impact:
- Bypass HMAC URL validation entirely
- Load images from arbitrary external domains
- Abuse Thumbor deployments as an open proxy or image fetcher
- Circumvent domain restrictions enforced by the signed URL mechanism
- Access restricted internal paths or resources normally protected by HMAC
- Potential information disclosure and further exploitation through path traversal
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
