Thumbor, an open-source photo thumbnail service, suffered a flaw in its file_loader component. After performing root-boundary validation, the loader decodes percent‑encoded path segments, enabling an attacker to supply a URL that resolves outside the intended file root. This permits unauthorized access to arbitrary files on the server, potentially exposing sensitive configuration or user data. The weakness is a classic path‑traversal vulnerability (CWE‑22).

Any Thumbor deployment using a version older than 7.8.0 is affected. The vulnerability was discovered in the upstream project maintained by Globo.com and was addressed in the 7.8.0 release. Users of earlier releases must check their installed version and plan an upgrade accordingly.

The CVSS score of 8.7 reflects a high severity with high availability impact. The EPSS score of less than 1% indicates that the exploit probability is currently low, and the issue is not listed in the CISA KEV catalog. The attack vector is likely remote, as an adversary can craft an HTTP request containing a percent‑encoded URL that bypasses root checks. If successfully exploited, the attacker could read, modify, or delete arbitrary files within the Thumbor instance.