Executive brief
Thumbor, an open-source photo thumbnail service, contains a security flaw in how it validates image sources. The service is designed to only fetch images from trusted websites, but a configuration error allows attackers to bypass these restrictions by using hostnames that look similar to trusted ones. This could allow an attacker to use the service to access internal data or unauthorized external content, potentially leading to data exposure or service misuse.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Thumbor's HTTP loader due to improper sanitization of the ALLOWED_SOURCES configuration. When hostnames are provided as plain strings in the configuration, they are passed directly to Python's re.match() without escaping. Because the dot character (.) is a regex wildcard, an attacker can bypass the allowlist by using a domain that matches the pattern but replaces dots with other characters (e.g., 'sXglbimgYcom' matching 's.glbimg.com'). This allows for unauthorized image fetching from arbitrary hosts. The issue is resolved in version 7.8.0 by applying re.escape() to string-based patterns.
Affected products
- globo.com thumbor < 7.8.0
Timeline
- 2026-05-30: patched: Fix committed to repository and version 7.8.0 released.
- 2026-06-10: advisory: GitHub Security Advisory GHSA-6x26-6r6f-m537 published.
- 2026-07-31: disclosed: CVE-2026-53500 published to NVD.