{"id":"PYSEC-2026-3617","summary":"Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot","details":"## Summary\n\nThe `ALLOWED_SOURCES` configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list (the overwhelming majority of real-world and documented configurations) are passed directly to `re.match()` without escaping. Because `.` is a regex wildcard, every dot in a domain name becomes a bypass vector: `s.glbimg.com` silently matches `sXglbimgYcom`, `sAglbimg.com`, and any other hostname that differs only at a dot position. This undermines the primary SSRF defence that `ALLOWED_SOURCES` is intended to provide.\n\n## Affected component\n\n`thumbor/loaders/http_loader.py` — `validate()`\n\n## Proof of concept\n\n```python\nimport re\nfrom thumbor.config import Config\nfrom thumbor.context import Context\nfrom thumbor.loaders import http_loader as loader\n\nconfig = Config()\nconfig.ALLOWED_SOURCES = [\"s.glbimg.com\"]   # typical user config\nctx = Context(None, config, None)\n\n# These should be blocked — both return True due to the unescaped dot\nprint(loader.validate(ctx, \"http://sXglbimgYcom/secret.jpg\"))  # True ← bypass\nprint(loader.validate(ctx, \"http://sAglbimg.com/secret.jpg\"))  # True ← bypass\n\n# Legitimate origin — correctly allowed\nprint(loader.validate(ctx, \"http://s.glbimg.com/logo.jpg\"))    # True ← correct\n```\n\n## Root cause\n\n`thumbor/loaders/http_loader.py` (before fix):\n\n```python\nfor pattern in context.config.ALLOWED_SOURCES:\n    if isinstance(pattern, Pattern):\n        match = url\n    else:\n        pattern = f\"^{pattern}$\"   # \u003c-- dots not escaped, act as regex wildcard\n        match = res.hostname\n\n    if re.match(pattern, match):\n        return True\n```\n\n## Impact\n\nAn attacker who can influence the image source URL passed to Thumbor can fetch images from arbitrary hosts, bypassing the `ALLOWED_SOURCES` allowlist.\n\n**Preconditions:**\n\n- `ALLOWED_SOURCES` contains at least one plain-string entry (the common case; all official documentation examples use plain strings).\n- The attacker can supply or influence the image URL — true whenever  `ALLOW_UNSAFE_URL = True` (the default), or when the application forwards user input to a signed URL endpoint.\n\n## Fix\n\nApply `re.escape()` to plain-string patterns before compiling them, so every\ncharacter is matched literally:\n\n```python\nelse:\n    pattern = f\"^{re.escape(pattern)}$\"   # dots and other metacharacters are now literal\n    match = res.hostname\n```\n\nThis is a one-call addition with no breaking change for correctly written configurations. Users who need real regular-expression behaviour should supply a compiled pattern (`re.compile(r\"s\\.glbimg\\.com\")`), which is already handled by the existing `isinstance(pattern, Pattern)` branch and is unaffected by this change.\n\nThe `ALLOWED_SOURCES` docstring in `config.py` was also updated to document the two-mode behaviour explicitly.","aliases":["CVE-2026-53500","GHSA-6x26-6r6f-m537"],"modified":"2026-08-04T14:30:30.167925503Z","published":"2026-08-04T11:34:46.220271Z","references":[{"type":"WEB","url":"https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537"},{"type":"WEB","url":"https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7"},{"type":"PACKAGE","url":"https://github.com/thumbor/thumbor"},{"type":"WEB","url":"https://github.com/thumbor/thumbor/releases/tag/7.8.0"},{"type":"PACKAGE","url":"https://pypi.org/project/thumbor"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6x26-6r6f-m537"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53500"}],"affected":[{"package":{"name":"thumbor","ecosystem":"PyPI","purl":"pkg:pypi/thumbor"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.0"}]}],"versions":["4.1.3","4.10.0","4.10.1","4.10.2","4.10.3","4.11.0","4.11.1","4.12.0","4.12.1","4.12.2","4.4.1","4.5.3","4.5.4","4.6.0","4.7.0","4.7.1","4.8.0","4.8.1","4.8.2","4.8.3","4.8.4","4.8.5","4.8.6","4.9.0","4.9.1","5.0.0","5.0.0rc1","5.0.0rc2","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.1.0","5.2.0","5.2.1","6.0.0","6.0.0b1","6.0.0b2","6.0.0b3","6.0.0b4","6.0.0b5","6.0.1","6.0.2","6.1.0","6.1.1","6.1.2","6.1.3","6.1.4","6.1.5","6.2.0","6.2.1","6.3.0","6.3.1","6.3.2","6.4.0","6.4.1","6.4.2","6.4.3","6.5.0","6.5.1","6.5.2","6.6.0","6.6.1","6.7.0","6.7.1","6.7.2","6.7.3","6.7.4","6.7.5","6.7.6","7.0.0","7.0.0a1","7.0.0a2","7.0.0a3","7.0.0a4","7.0.0a5","7.0.0b1","7.0.1","7.0.10","7.0.11","7.0.12","7.0.2","7.0.3","7.0.5","7.0.6","7.0.7","7.0.8","7.0.9","7.1.0","7.1.1","7.1.2","7.2.0","7.2.1","7.3.0","7.3.1","7.3.2","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.4.5","7.4.6","7.4.7","7.5.0","7.5.1","7.5.2","7.6.0","7.7.0","7.7.1","7.7.2","7.7.3","7.7.4","7.7.5","7.7.6","7.7.7"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/thumbor/PYSEC-2026-3617.yaml"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L"}]}