high8.2
CVE-2026-53500
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
Impact
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | thumbor | <= 7.7.7 | 7.8.0 |