CVE-2022-24303: Path Traversal in Pillow
Summary
CVE-2022-24303: Path traversal in Pillow. Affects pillow versions < 9.0.1. Fixed in 9.0.1. How to fix ↓
Also tracked for
- pillow · Bitnami
- py3-pillow · Alpine:v3.15
The same CVE-2022-24303 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python imaging library (PIL) that provides support for opening, manipulating, and saving many different image file formats. It is widely used in various applications for image processing and manipulation. However, a vulnerability has been discovered in Pillow that allows for path traversal attacks on Linux and macOS systems. This vulnerability has been present since PIL and can potentially lead to the removal of unrelated files if the path to the temporary directory contains a space.
Vulnerability Detail
The path traversal vulnerability in Pillow arises when the temporary directory path on Linux or macOS contains a space. This issue specifically affects the removal of temporary image files after certain actions, such as im.show(). An attacker can exploit this vulnerability to manipulate the path and potentially delete unintended files on the system. This vulnerability has been assigned a CVSS score of 9.1, indicating its critical severity.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.0.1
This is the first release that contains the fix.
pip install --upgrade "pillow==9.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Pillow is not immediately feasible, users can implement a workaround by avoiding the use of temporary directories with spaces in their paths. This can be achieved by specifying a different temporary directory or ensuring that the temporary directory path does not contain any spaces.
Conclusion
The path traversal vulnerability in Pillow can have severe consequences, potentially leading to the removal of unintended files. It is crucial to update to the latest version of Pillow (9.0.1 or later) to mitigate this vulnerability. Alternatively, users can implement the provided workaround to avoid using temporary directories with spaces in their paths. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python imaging library (PIL) that provides support for opening, manipulating, and saving various image file formats.
Path traversal is a vulnerability that allows an attacker to access files or directories outside of the intended scope by manipulating file paths.
This vulnerability in Pillow can potentially lead to the unintended removal of files on Linux and macOS systems if the temporary directory path contains a space.
This vulnerability has been assigned a CVSS score of 9.1, indicating its critical severity.
To fix this vulnerability, it is recommended to upgrade to Pillow version 9.0.1 or later using the command 'pip install --upgrade pillow'.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
