This issue specifically impacts configurations where file_loader is used and the watermark or frame filters are enabled. An attacker can leverage this to read arbitrary files from the server's filesystem, including sensitive configuration files or keys, and receive the file contents overlaid as an image if the data can be parsed as an image format. This affects Thumbor versions 7.7.7 and below.

Attack Chain

1. Attacker constructs a malicious URL targeting a Thumbor watermark filter endpoint (e.g., /unsafe/filters:watermark(...)).
2. Attacker embeds double-encoded path traversal sequences (e.g., %252e%252e) into the watermark image path parameter.
3. The web server (Tornado) decodes the first layer of encoding, passing %2e%2e to the application logic.
4. The file_loader receives the path and performs abspath(), which treats the literal %2e%2e as a directory name, causing the startswith(ROOT) security check to return True.
5. The file_loader identifies the path as non-existent (as the literal directory doesn't exist) and proceeds to call unquote().
6. The unquote() function decodes %2e%2e into .., effectively enabling directory traversal.
7. The application opens the file requested from the filesystem, traversing outside the FILE_LOADER_ROOT_PATH.
8. The file content is returned to the user, potentially displaying sensitive file data as an image artifact.

Impact

Successful exploitation results in unauthorized arbitrary file read on the host server. This allows attackers to access critical system files, application configuration files, and environment secrets, which may lead to further compromise of the underlying infrastructure or exfiltration of sensitive organizational data.

Recommendation

• Upgrade Thumbor to a version that performs URL decoding prior to filesystem path validation.
• Implement strict ingress filtering on web application firewalls to block double-percent-encoded characters (%252e) in query parameters targeting watermark or frame filters.
• Deploy the Sigma rule below to detect attempts to inject encoded traversal sequences into the application.
• Audit logs for HTTP 200 responses originating from watermark or frame filter endpoints that involve character strings suggestive of path traversal.