Executive brief
Thumbor, an open-source photo processing service used to generate image thumbnails, is vulnerable to a flaw that allows remote attackers to crash the service. By providing a specific invalid value to the image convolution filter, an attacker can trigger a fatal error in the application's underlying code. This results in a denial of service, preventing the system from processing images for legitimate users and potentially impacting website performance or availability.
Technical details
A divide-by-zero vulnerability (CWE-369) exists in Thumbor's convolution filter C extension (thumbor/ext/filters/_convolution.c). The Python entry point for the 'filters:convolution' method uses 'BaseFilter.PositiveNumber', which incorrectly allows a value of 0 for the 'columns' parameter. This value is passed to the native C extension and used as a divisor in modulo and division operations without validation. On x86_64 architectures, this triggers a SIGFPE (fatal arithmetic exception), crashing the Thumbor process. The vulnerability is exploitable remotely via unauthenticated requests if '/unsafe/' URLs are enabled, or via signed URLs if they are not. The issue is resolved in version 7.8.0 by enforcing 'PositiveNonZeroNumber' in the Python layer and adding validation guards in the C extension.
Affected products
- globo.com thumbor < 7.8.0
Timeline
- 2023-05-30: patched: Version 7.8.0 released
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: NVD publication date