CyberRota Analysis
AI-GeneratedThumbor versions prior to 7.8.0 are vulnerable to a path traversal attack due to improper handling of percent-encoded path segments in the file_loader component, which can allow attackers to access files outside the designated root directory. This vulnerability can lead to unauthorized file access, potentially exposing sensitive data. Organizations using affected versions of Thumbor should prioritize upgrading to version 7.8.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through watermark or frame filter input. This issue is fixed in 7.8.0.