Thumbor
Monthly
Server-side request forgery in Thumbor prior to 7.8.0 allows unauthenticated remote attackers to bypass the ALLOWED_SOURCES hostname allowlist - the service's primary SSRF defense - and cause Thumbor to fetch images from arbitrary hosts, including internal network resources. The bypass exploits Python's regex engine treating unescaped dots as wildcards: an allowlist entry of 's.glbimg.com' silently matches attacker-controlled hostnames like 'sXglbimgYcom'. Because ALLOW_UNSAFE_URL defaults to True and all official documentation examples use plain-string patterns, the preconditions for exploitation match the default deployment profile. No public KEV listing, but a vendor-confirmed proof-of-concept is embedded in GitHub security advisory GHSA-6x26-6r6f-m537.
Server-side request forgery in Thumbor prior to 7.8.0 allows unauthenticated remote attackers to bypass the ALLOWED_SOURCES hostname allowlist - the service's primary SSRF defense - and cause Thumbor to fetch images from arbitrary hosts, including internal network resources. The bypass exploits Python's regex engine treating unescaped dots as wildcards: an allowlist entry of 's.glbimg.com' silently matches attacker-controlled hostnames like 'sXglbimgYcom'. Because ALLOW_UNSAFE_URL defaults to True and all official documentation examples use plain-string patterns, the preconditions for exploitation match the default deployment profile. No public KEV listing, but a vendor-confirmed proof-of-concept is embedded in GitHub security advisory GHSA-6x26-6r6f-m537.