Thumbor, an open‑source image thumbnail service, uses a signed URL mechanism to verify the authenticity of the requested image. Prior to version 7.8.0, the signature validation logic employed Python’s .replace() to strip the signature string from the URL. Since .replace() eliminates every occurrence of the substring, an attacker can embed multiple copies of the signature within the URL, causing the final string used for validation to diverge from the actual request. This flaw allows the creation of URLs that pass validation yet point to resources outside the authorized scope, facilitating the loading of images from unexpected domains or file paths.

Any Thumbor deployment running a version older than 7.8.0 is affected. The vulnerability is present in the open‑source thumbor project maintained by Globo.com and applies to all builds that have not applied the 7.8.0 release or later.

The CVSS score of 8.2 indicates a high severity, and although the EPSS score is less than 1%, the flaw remains exploitable via crafted URLs that can be accessed remotely. The issue is not yet listed in CISA KEV, but attackers could use it to exfiltrate or manipulate image content, potentially leading to information disclosure or content injection. The exploitation requires only URL manipulation; no additional access credentials are needed.