An unauthenticated Server-Side Request Forgery vulnerability in Thumbor exposes the underlying infrastructure to unauthorized internal requests and potential data exfiltration.

The application is affected by a Server-Side Request Forgery (SSRF) vulnerability due to insufficient input validation. An unauthenticated attacker can leverage this flaw to send crafted requests to internal services or external resources.

This vulnerability carries a CVSS score of 8.2, reflecting the high risk posed by SSRF in a service environment. Successful exploitation could allow an attacker to bypass firewalls, interact with internal metadata services, or exfiltrate sensitive data from the internal network.

Immediate Action: Upgrade the Thumbor installation to version 7.8.0 or higher to resolve the underlying request validation flaw.

Proactive Monitoring: Monitor outbound network traffic from the Thumbor server for requests directed toward internal IP ranges or sensitive internal resources.

Compensating Controls: Ensure the service runs in a restricted network environment with minimal egress permissions to limit the scope of potential SSRF attacks.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

The presence of a proof-of-concept elevates the risk profile of this vulnerability. Administrators must treat this as a high-priority update and move to version 7.8.0 immediately to prevent potential exploitation of the server-side request handling logic.