Thumbor, an open-source photo thumbnail service by globo.com, contains a security flaw in versions prior to 7.8.0. The ALLOWED_SOURCES configuration passes plain strings directly to Python's re.match() function without escaping dot characters. In regular expressions, an unescaped dot matches any character, meaning a malicious hostname differing from an allowlisted hostname only at dot positions could bypass the allowlist check. This could allow unauthorized image sources to be used, potentially enabling Server-Side Request Forgery (SSRF) or content injection attacks. The vulnerability has been patched in Thumbor version 7.8.0, which properly escapes dots in the allowlist strings before passing them to the regex engine. Users are advised to upgrade to 7.8.0 or later immediately.