{"schema":"threatline.record/2","record":{"id":"CVE-2026-53500","aliases":["GHSA-6x26-6r6f-m537","PYSEC-2026-3617"],"summary":"Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot","details":"## Summary\n\nThe `ALLOWED_SOURCES` configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list (the overwhelming majority of real-world and documented configurations) are passed directly to `re.match()` without escaping. Because `.` is a regex wildcard, every dot in a domain name becomes a bypass vector: `s.glbimg.com` silently matches `sXglbimgYcom`, `sAglbimg.com`, and any other hostname that differs only at a dot position. This undermines the primary SSRF defence that `ALLOWED_SOURCES` is intended to provide.\n\n## Affected component\n\n`thumbor/loaders/http_loader.py` — `validate()`\n\n## Proof of concept\n\n```python\nimport re\nfrom thumbor.config import Config\nfrom thumbor.context import Context\nfrom thumbor.loaders import http_loader as loader\n\nconfig = Config()\nconfig.ALLOWED_SOURCES = [\"s.glbimg.com\"]   # typical user config\nctx = Context(None, config, None)\n\n# These should be blocked — both return True due to the unescaped dot\nprint(loader.validate(ctx, \"http://sXglbimgYcom/secret.jpg\"))  # True ← bypass\nprint(loader.validate(ctx, \"http://sAglbimg.com/secret.jpg\"))  # True ← bypass\n\n# Legitimate origin — correctly allowed\nprint(loader.validate(ctx, \"http://s.glbimg.com/logo.jpg\"))    # True ← correct\n```\n\n## Root cause\n\n`thumbor/loaders/http_loader.py` (before fix):\n\n```python\nfor pattern in context.config.ALLOWED_SOURCES:\n    if isinstance(pattern, Pattern):\n        match = url\n    else:\n        pattern = f\"^{pattern}$\"   # <-- dots not escaped, act as regex wildcard\n        match = res.hostname\n\n    if re.match(pattern, match):\n        return True\n```\n\n## Impact\n\nAn attacker who can influence the image source URL passed to Thumbor can fetch images from arbitrary hosts, bypassing the `ALLOWED_SOURCES` allowlist.\n\n**Preconditions:**\n\n- `ALLOWED_SOURCES` contains at least one plain-string entry (the common case; all official documentation examples use plain strings).\n- The attacker can supply or influence the image URL — true whenever  `ALLOW_UNSAFE_URL = True` (the default), or when the application forwards user input to a signed URL endpoint.\n\n## Fix\n\nApply `re.escape()` to plain-string patterns before compiling them, so every\ncharacter is matched literally:\n\n```python\nelse:\n    pattern = f\"^{re.escape(pattern)}$\"   # dots and other metacharacters are now literal\n    match = res.hostname\n```\n\nThis is a one-call addition with no breaking change for correctly written configurations. Users who need real regular-expression behaviour should supply a compiled pattern (`re.compile(r\"s\\.glbimg\\.com\")`), which is already handled by the existing `isinstance(pattern, Pattern)` branch and is unaffected by this change.\n\nThe `ALLOWED_SOURCES` docstring in `config.py` was also updated to document the two-mode behaviour explicitly.","categories":["Libraries & packages"],"product":"thumbor","vendor":"thumbor","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-6x26-6r6f-m537","source_modified_at":"2026-09-30T18:44:16Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"thumbor"},"range":"<= 7.7.7"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53500","source_modified_at":"2026-07-31T23:30:44.046Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"thumbor","vendor":"thumbor","versions":[{"status":"affected","version":"< 7.8.0"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-6x26-6r6f-m537","source_modified_at":"2026-08-04T14:40:34.274877182Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"thumbor","ecosystem":"PyPI","purl":"pkg:pypi/thumbor"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.0"}]}],"versions":["4.1.3","4.10.0","4.10.1","4.10.2","4.10.3","4.11.0","4.11.1","4.12.0","4.12.1","4.12.2","4.4.1","4.5.3","4.5.4","4.6.0","4.7.0","4.7.1","4.8.0","4.8.1","4.8.2","4.8.3","4.8.4","4.8.5","4.8.6","4.9.0","4.9.1","5.0.0","5.0.0rc1","5.0.0rc2","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.1.0","5.2.0","5.2.1","6.0.0","6.0.0b1","6.0.0b2","6.0.0b3","6.0.0b4","6.0.0b5","6.0.1","6.0.2","6.1.0","6.1.1","6.1.2","6.1.3","6.1.4"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-6x26-6r6f-m537","source_modified_at":"2026-09-30T18:44:16Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"thumbor"},"version":"7.8.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-6x26-6r6f-m537","source_modified_at":"2026-08-04T14:40:34.274877182Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"thumbor","ecosystem":"PyPI","purl":"pkg:pypi/thumbor"},"version":"7.8.0"}],"cvss":8.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00498,"percentile":0.41812,"score_date":"2026-10-23"},"published_at":"2026-07-31T18:35:54.234Z","modified_at":"2026-09-30T18:44:16Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-6x26-6r6f-m537","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-30T18:44:16Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-53500","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-07-31T23:30:44.046Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-6x26-6r6f-m537","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-08-04T14:40:34.274877182Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53500","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/thumbor/thumbor/releases/tag/7.8.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-6x26-6r6f-m537","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-07-31T23:29:34.062473Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-30T18:44:16Z","content_hash":"9a796edc81b1db45b26c688c68e9ed9970d92d75ef548a996dbf77dce6898ff0"}}