Thumbor vulnerabilities
We track 6 vulnerabilities in Thumbor products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on July 31, 2026.
Latest Thumbor vulnerabilities
- 7.5 High severity
thumbor: Uncontrolled Resource Consumption
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/m
- 7.5 High severity
thumbor: Uncontrolled Resource Consumption
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixe
- 7.5 High severity
Thumbor is an open-source photo thumbnail service by globo.com.
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where
- 8.7 High severity
thumbor: Improper Limitation of a Pathname to a Restricted Directory
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through watermark or frame filter input. This
- 8.2 High severity
thumbor: Improper Verification of Cryptographic Signature
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences
- 8.2 High severity
thumbor: Server-Side Request Forgery
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in