Detections
Analytics

SCA: security update for thumbor (GHSA-mw3h-qjxj-6xg9)

high Tenable Cloud Security Plugin ID 445528

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation
 can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before
 validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same
 signature multiple times in the URL and manipulate the final URL used for validation. This allows crafting
 URLs where the validated string differs from the actual requested resource, enabling loading images from
 unintended domains or paths. This issue is fixed in 7.8.0. (CVE-2026-53501)

Solution

Update the thumbor library and its related packages to version 7.8.0 or later.

See Also

https://github.com/advisories/GHSA-mw3h-qjxj-6xg9

Plugin Details

Severity: High

ID: 445528

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/1/2026

Updated: 8/1/2026

Risk Information

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:P

CVSS Score Source: CVE-2026-53501

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/31/2026

Vulnerability Publication Date: 7/31/2026

Reference Information

CVE: CVE-2026-53501

cwe: CWE-347