thumbor 7.7.7

Direct Vulnerabilities

Known vulnerabilities in the thumbor package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Directory Traversal thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Directory Traversal via the `file_loader` process. An attacker can access arbitrary files outside the intended directory by supplying specially crafted, percent-encoded path traversal sequences that bypass security checks and are later decoded to actual traversal characters. This is only exploitable if the loader is set to `thumbor.loaders.file_loader` (or `file_loader_http_fallback`), `ALLOW_UNSAFE_URL` is enabled, and watermark or frame filters are active by default. How to fix Directory Traversal? Upgrade `thumbor` to version 7.8.0 or higher.	[,7.8.0)
H Regular Expression Denial of Service (ReDoS) thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the `validate` process. An attacker can access unauthorized external resources by supplying crafted hostnames that exploit unescaped regex patterns in the configuration. This is only exploitable if the configuration contains at least one plain-string entry in the allowed sources and the attacker can influence the image URL, such as when unsafe URLs are permitted or user input is forwarded to a signed URL endpoint. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `thumbor` to version 7.8.0 or higher.	[,7.8.0)
H Denial of Service (DoS) thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Denial of Service (DoS) via the `proportion` filter process. An attacker can exhaust system resources and cause service disruption by supplying an excessively large value to the `proportion` parameter, resulting in unbounded image resizing operations. This is only exploitable if the `proportion` filter is enabled (enabled by default), and either `/unsafe/` URLs are allowed or the attacker possesses a valid signed URL. How to fix Denial of Service (DoS)? Upgrade `thumbor` to version 7.8.0 or higher.	[,7.8.0)
H Improper Verification of Cryptographic Signature thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the URL signature removal process. An attacker can manipulate the validated URL and bypass intended access controls by injecting additional signature substrings into the request path, resulting in the loading of resources from unauthorized domains or paths. How to fix Improper Verification of Cryptographic Signature? Upgrade `thumbor` to version 7.8.0 or higher.	[,7.8.0)
H Regular Expression Denial of Service (ReDoS) thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `convolution` filter regular expression. An attacker can cause the application to become unresponsive by submitting specially crafted input that triggers excessive backtracking in the regular expression engine. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `thumbor` to version 7.8.0 or higher.	[,7.8.0)
H Division by zero thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Division by zero via the `convolution` filter process in the C extension when user-controlled input is used as a divisor without validation. An attacker can cause the process to crash and disrupt service by supplying a crafted value that triggers a divide-by-zero error. This is only exploitable if the `convolution` filter is enabled (enabled by default), and either `/unsafe/` URLs are allowed or the attacker has access to a valid signed URL. How to fix Division by zero? Upgrade `thumbor` to version 7.8.0 or higher.	[,7.8.0)

Vulnerability

Vulnerable Version

Directory Traversal