thumbor vulnerabilities (PyPI)
6 vulnerabilities.
-
thumborPyPI Thumbor has path traversal via post-validation URL decoding bypass in file_loader 8.7 High -
thumborPyPI Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS 7.5 High -
thumborPyPI Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter 7.5 High -
thumborPyPI Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS 7.5 High -
thumborPyPI Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature 8.2 High -
thumborPyPI Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot 8.2 High