Executive brief
Thumbor is an open-source service used to resize and process images on the fly. A security flaw in how it handles file paths allows an attacker to bypass security restrictions and access sensitive files on the server, such as configuration files or system secrets. This could lead to the exposure of private data or credentials used by the organization.
Technical details
A path traversal vulnerability exists in Thumbor's 'file_loader' component due to improper input validation order. The loader performs security checks (abspath and startswith) on the file path before applying URL decoding (unquote). An attacker can provide double-encoded or percent-encoded traversal sequences (e.g., %252e%252e) via the watermark or frame filters. These sequences bypass the initial directory boundary check as literal strings but are subsequently decoded into '..' sequences, allowing the attacker to read arbitrary files outside the intended root directory. This issue is resolved in version 7.8.0 by enforcing root boundaries after decoding.
Affected products
- thumbor thumbor < 7.8.0
Timeline
- 2026-05-30: patched: Version 7.8.0 released
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE published to NVD