CyberRota Analysis
AI-GeneratedThumbor versions prior to 7.8.0 are vulnerable due to the lack of an upper bound on the <value> parameter in the filters:proportion(<value>) filter, allowing attackers to exploit this flaw to trigger excessive resource consumption, leading to denial of service. Organizations using Thumbor for image processing should prioritize upgrading to version 7.8.0 or later to mitigate the risk of CPU and memory exhaustion attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service. This issue is fixed in 7.8.0.