Thumbor EUVD-2026-51597

Exploitation requires two conditions, both of which match Thumbor's default and documented deployment profile. First, ALLOWED_SOURCES must contain at least one plain-string hostname entry; this is the overwhelmingly common configuration because all official documentation examples use plain strings and the configuration description prior to 7.8.0 described entries as 'regular expressions,' encouraging users to write domain names directly. Second, the attacker must be able to influence the image source URL submitted to Thumbor, which is true by default when ALLOW_UNSAFE_URL=True (Thumbor's default) or when the application forwards user-controlled input to a signed URL endpoint. Instances where ALLOWED_SOURCES is empty (no allowlist enforced) are not protected by this check regardless. Instances where ALLOWED_SOURCES is populated exclusively with pre-compiled re.Pattern objects are not affected by the bypass, as compiled patterns are handled via a separate code path. Exploitation is scoped to Thumbor versions prior to 7.8.0 on the pip/thumbor package.

The CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) reflects unauthenticated remote exploitation with high confidentiality impact, consistent with SSRF enabling access to internal network resources and metadata services. The base vector metrics are accurate given that Thumbor's default configuration (ALLOW_UNSAFE_URL=True, plain-string ALLOWED_SOURCES) satisfies both preconditions for exploitation without any non-default setup. EPSS data was not provided, so statistical exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, meaning active widespread exploitation is not confirmed, but a detailed proof-of-concept with working Python code is vendor-published in the GitHub advisory, significantly lowering the bar for exploitation. The combination of a trivial bypass mechanism, default-on preconditions, and published PoC makes this a genuine priority for any public-facing Thumbor deployment, despite the absence of KEV confirmation. The partial A:L impact likely reflects potential for resource exhaustion by directing Thumbor to fetch large payloads from internal hosts.

An attacker targets a public-facing Thumbor instance running a version prior to 7.8.0 with its default ALLOW_UNSAFE_URL=True setting and an ALLOWED_SOURCES list containing 's.glbimg.com'. They submit a request to Thumbor's unsafe endpoint specifying an image URL hosted at 'sXglbimgYcom' - an attacker-controlled domain whose name satisfies the unescaped dot regex - causing Thumbor's HTTP loader to fetch and proxy content from that host, potentially including responses that probe internal network topology or cloud metadata endpoints. A working proof-of-concept demonstrating this bypass is included verbatim in the vendor's GitHub security advisory.