CVE-2026-53502 — Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Affected: thumbor

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through watermark or frame filter input. This issue is fixed in 7.8.0.

PYSEC-2026-3618 — Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Affected: PyPI: thumbor

The file_loader performs `unquote()` on the file path AFTER the `abspath() + startswith()` security check. An attacker can use percent-encoded path traversal sequences (`%2e%2e` for `..`) that pass the security check as literal directory names, but are then decoded to actual `..` traversal sequences.

## Affected code

`thumbor/loaders/file_loader.py` lines 28-49: ```python async def load(context, path): file_path = join( context.config.FILE_LOADER_ROOT_PATH.rstrip("/"), path.lstrip("/") ) file_path = abspath(file_path) inside_root_path = file_path.startswith( # Security check abspath(context.config.FILE_LOADER_ROOT_PATH) ) result = LoaderResult() if not inside_root_path: result.error = LoaderResult.ERROR_NOT_FOUND result.successful = False return result

if not exists(file_path): file_path = unquote(file_path) # unquote AFTER check!

if exists(file_path) and isfile(file_path): with open(file_path, "rb") as source_file: ... ```

The watermark and frame filters pass their URL parameters directly to the loader without re-encoding (unlike the main image URL flow which applies `quote()` in `imaging.py` line 37).

## PoC

```bash # Read /etc/passwd via watermark filter path traversal # %252e is double-encoded: Tornado decodes to %2e, filter passes to file_loader, # file_loader unquote decodes %2e to . curl 'http://thumbor-host:8888/unsafe/filters:watermark…

Most recent entries from all

CVE-2026-53502 — Thumbor has path traversal via post-validation URL decoding bypass in file_loader

PYSEC-2026-3618 — Thumbor has path traversal via post-validation URL decoding bypass in file_loader