Thumbor incorrectly treats plain string entries in its ALLOWED_SOURCES configuration as unescaped regular expressions. Because dot characters are not escaped in these strings, hostnames that differ only in their dot positions can satisfy a pattern intended for an unrelated host. As a result, an attacker can cause Thumbor to fetch images from arbitrary external sources, potentially exposing sensitive data or facilitating server‑side request forgery.

The affected product is Thumbor and its open‑source image‑thumbnail service by Globo.com. All releases prior to version 7.8.0 are vulnerable when the ALLOWED_SOURCES setting contains plain string patterns. Users should verify that their deployed Thumbor installation is using a version earlier than 7.8.0 and that the configuration has not been altered to include such patterns.

Thumbor operates as a web service that retrieves images from provided URLs. An attacker can exploit the vulnerability by crafting a request with a hostname that matches a bypassed pattern in ALLOWED_SOURCES and thus force the service to pull content from a malicious or otherwise restricted host. The CVSS score of 8.2 indicates high severity, yet the EPSS score of less than 1% suggests that exploitation attempts are unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. The primary attack vector is remote, triggered through the public image‑generation endpoint, and requires that the server is reachable and that a misconfigured ALLOWED_SOURCES list is present.