PyPI/thumbor CVE-2026-53500: high 8.2, EPSS 0.50%

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Action: Upgrade thumbor to 7.8.0 or later.

pip install thumbor==7.8.0

Affected

Fixed versions

Sources

• osv: GHSA-6x26-6r6f-m537
• https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537
• https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7
• https://github.com/thumbor/thumbor
• https://github.com/thumbor/thumbor/releases/tag/7.8.0

CVE-2026-53500 · published 2026-07-31T18:36:03Z · modified 2026-08-04T14:40:34.274877182Z · JSON