113 matches found
CVE-2026-53505: Uncontrolled Resource Consumption
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes CPU/memory exhaustion and cause denial of service. This issu...
PT-2026-66838
Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description HMAC validation can be bypassed due to the use of the Python .replace method when removing the signature from the URL before validation. Because .replace removes all occurrences of the substring rath...
CVE-2026-53502: Improper Limitation of a Pathname to a Restricted Directory
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...
PT-2026-66839
Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description An issue exists in the file loader where percent-encoded path segments are decoded after the root-boundary validation. This occurs because the unquote function is applied to the file path after the...
CVE-2026-53503: Improper Input Validation
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution , , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the ...
CVE-2026-53504: Uncontrolled Resource Consumption
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0...
CVE-2026-53500: Server-Side Request Forgery (SSRF)
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...
PT-2026-66836
Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description The ALLOWED SOURCES configuration, designed to restrict the hosts from which the HTTP loader fetches images, fails to escape dots when processing plain-string entries. These strings are passed direct...
PT-2026-66841
Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description The convolution filter regular expression performs exponential backtracking when processing crafted repeated numeric input. This leads to a Regular Expression Denial of Service ReDoS, where a special...
PT-2026-66842
Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description The filters:proportion filter does not enforce an upper bound on the value parameter and operates during the post-transform phase. This allows an attacker to trigger extremely large image resizes,...
PT-2026-66840
Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description A remote denial of service exists in the filters:convolution, , filter. The filter passes the user-controlled columns variable to a C extension thumbor/ext/filters/ convolution.c where it is used as ...
CVE-2026-53501: Improper Verification of Cryptographic Signature
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can insert...
