Executive brief
Thumbor, an open-source photo processing service, contains a security flaw in how it verifies signed web addresses. By including the security signature multiple times within a single request, an attacker can trick the system into validating a different destination than the one actually being requested. This allows unauthorized users to bypass security restrictions, potentially using the service to fetch images from unintended domains or bypass access controls.
Technical details
A signature bypass vulnerability exists in Thumbor's HMAC validation logic due to the improper use of Python's `str.replace()` method. When validating a request, Thumbor attempts to strip the HMAC signature from the URL to reconstruct the original string for verification; however, because `replace()` removes all occurrences of the substring, an attacker can inject the valid signature multiple times into the URL path. This causes the validation routine to strip the injected signatures as well, resulting in a 'validated' URL that differs from the actual requested resource path. This allows for path manipulation and the loading of images from unauthorized domains. The issue is resolved in version 7.8.0 by switching to a prefix-based strip mechanism.
Affected products
- thumbor thumbor < 7.8.0
Timeline
- 2026-05-30: patched: Version 7.8.0 released
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE published to NVD