Listen to this Post
Thumbor versions prior to 7.8.0 contain a vulnerability in the `filters:proportion(MAX_HEIGHT—that are applied earlier in the request lifecycle to `req.width` and req.height.
The filter computes new image dimensions as `new_width = source_width value` and new_height = source_height value, then calls engine.resize(new_width, new_height). Although the official documentation states that the percentage argument should be between `0.0` and 1.0, the implementation fails to enforce this constraint. An attacker can supply an extremely large value (e.g., 10000), triggering massive image resizing that exhausts CPU and memory resources, leading to denial of service.
Exploitation depends on deployment configuration. If `/unsafe/` URLs are enabled (ALLOW_UNSAFE_URL=True), an unauthenticated attacker can exploit this remotely. If `/unsafe/` is disabled, the attacker requires a valid signed URL—meaning the attacker must be an authorized user, partner, or have obtained signed URLs issued by a trusted signing service. The vulnerability is fixed in Thumbor version 7.8.0.
DailyCVE Form:
Platform: Thumbor
Version: < 7.8.0
Vulnerability: Unbounded post-transform resize
Severity: HIGH (CVSS 7.5)
Date: 2026-07-31
Prediction: 2026-07-31 (already published)
What Undercode Say:
Check Thumbor version pip show thumbor | grep Version Check if /unsafe/ is enabled (common in default deployments) Look for ALLOW_UNSAFE_URL=True in configuration
The vulnerability resides in thumbor/filters/proportion.py. The `value` is parsed as a float using `BaseFilter.DecimalNumber` with no maximum validation. The filter executes in the default `POST_TRANSFORM` phase, bypassing earlier size clamping. The documentation in `docs/proportion.rst` states the value should be `0.0` to 1.0, but the code does not enforce this.
Exploit:
Preconditions:
- The `proportion` filter is enabled by default via
BUILTIN_FILTERS. - Either `/unsafe/` URLs are allowed (
ALLOW_UNSAFE_URL=True), OR the attacker has a valid signed URL.
Example request 1 (signed URL):
http://<host>:<port>/<url-sign>/100x100/filters:proportion(10000)/example.jpg
Example request 2 (/unsafe/):
http://<host>:<port>/unsafe/100x100/filters:proportion(10000)/example.jpg
Sending such a request triggers `new_width = source_width 10000` and new_height = source_height 10000, causing extreme CPU/memory exhaustion and potentially process crash or OOM kill.
Protection:
Upgrade to Thumbor version 7.8.0 or later, which enforces strict bounds on the `proportion` parameter, limiting it to values between `0.0` and `1.0` as documented.
If upgrading is not immediately possible:
- Disable `/unsafe/` URLs (
ALLOW_UNSAFE_URL=False). - Tightly control signed URLs and ensure they are not exposed to untrusted parties.
- Consider removing the `proportion` filter from `BUILTIN_FILTERS` if not required.
Impact:
- Remote Denial of Service via CPU and/or memory exhaustion, potentially leading to process crash or OOM kill.
- If `/unsafe/` is enabled: unauthenticated remote DoS.
- If `/unsafe/` is disabled: exploitation requires a valid signed URL, reducing exposure but still posing risk to any party who can generate or use signed URLs.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
