Security Advisory

CVE-2026-53500

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-31 18:35:54

Last updated 2026-07-31 23:30:44

Assigner GitHub_M

CVSS score not scored

State PUBLISHED

Description

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0.

← Browse all CVEs View on cve.org ↗