Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

thumbor

6 known vulnerabilities (6 high), with the versions each affects and the releases that fix them.

Latest release
7.8.0 (May 30, 2026): no advisory affects it
Newest unaffected release
7.8.0 (May 30, 2026), the latest release
Advisories
6 · 6 high
Weekly downloads
6,316
Dependents
24
Releases
118 since 4.1.3 (Jan 7, 2015)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • Thumbor has path traversal via post-validation URL decoding bypass in file_loader

    Affected: fixed in 7.8.0.

    Fixed in 7.8.0 (released May 30, 2026, 62 days before disclosure).

    The latest release, 7.8.0, is not affected.

  • Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

    Affected: fixed in 7.8.0.

    Fixed in 7.8.0 (released May 30, 2026, 62 days before disclosure).

    The latest release, 7.8.0, is not affected.

  • Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

    Affected: fixed in 7.8.0.

    Fixed in 7.8.0 (released May 30, 2026, 62 days before disclosure).

    The latest release, 7.8.0, is not affected.

  • Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

    Affected: fixed in 7.8.0.

    Fixed in 7.8.0 (released May 30, 2026, 62 days before disclosure).

    The latest release, 7.8.0, is not affected.

  • Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

    Affected: fixed in 7.8.0.

    Fixed in 7.8.0 (released May 30, 2026, 62 days before disclosure).

    The latest release, 7.8.0, is not affected.

  • Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

    Affected: fixed in 7.8.0.

    Fixed in 7.8.0 (released May 30, 2026, 62 days before disclosure).

    The latest release, 7.8.0, is not affected.