[GHSA] GHSA-cj54-hpcc-gj6h (high) — Thumbor has path traversal via post-validation URL decoding bypass in file_loader

GHSA-cj54-hpcc-gj6h Severity: high CVE: CVE-2026-53502

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

The file_loader performs `unquote()` on the file path AFTER the `abspath() + startswith()` security check. An attacker can use percent-encoded path traversal sequences (`%2e%2e` for `..`) that pass the security check as literal directory names, but are then dec