EUVD-2026-51597
GHSA-6x26-6r6f-m537
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Default ALLOW_UNSAFE_URL=True means no authentication required; SSRF yields high confidentiality via internal resource access with no integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Lifecycle Timeline
4Blast Radius
ecosystem impact- 24 pypi packages depend on thumbor (24 direct, 0 indirect)
Ecosystem-wide dependent count for version 7.8.0.
DescriptionCVE.org
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0.
AnalysisAI
Server-side request forgery in Thumbor prior to 7.8.0 allows unauthenticated remote attackers to bypass the ALLOWED_SOURCES hostname allowlist - the service's primary SSRF defense - and cause Thumbor to fetch images from arbitrary hosts, including internal network resources. The bypass exploits Python's regex engine treating unescaped dots as wildcards: an allowlist entry of 's.glbimg.com' silently matches attacker-controlled hostnames like 'sXglbimgYcom'. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two conditions, both of which match Thumbor's default and documented deployment profile. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) reflects unauthenticated remote exploitation with high confidentiality impact, consistent with SSRF enabling access to internal network resources and metadata services. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targets a public-facing Thumbor instance running a version prior to 7.8.0 with its default ALLOW_UNSAFE_URL=True setting and an ALLOWED_SOURCES list containing 's.glbimg.com'. They submit a request to Thumbor's unsafe endpoint specifying an image URL hosted at 'sXglbimgYcom' - an attacker-controlled domain whose name satisfies the unescaped dot regex - causing Thumbor's HTTP loader to fetch and proxy content from that host, potentially including responses that probe internal network topology or cloud metadata endpoints. … |
| Remediation | Upgrade to Thumbor 7.8.0 or later via 'pip install --upgrade thumbor'; this is the definitive fix confirmed by the vendor release at https://github.com/thumbor/thumbor/releases/tag/7.8.0 and the patch commit at https://github.com/thumbor/thumbor/commit/68876715350c6c8f49c324e5515e64908830aed7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Thumbor deployments to identify instances running versions below 7.8.0; immediately restrict network access or disable image-fetch functionality for vulnerable instances to prevent exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today