CVE-2014-1933: Python Image Library (PIL) Symlink Attack
Summary
CVE-2014-1933: Pillow Temporary file name leakage. Affects pillow versions < 2.3.1. Fixed in 2.3.1. How to fix ↓
Also tracked for
- pillow · Debian:11
The same CVE-2014-1933 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Image Library (PIL) is a popular open-source library used for image processing in Python. It provides various functionalities for manipulating and working with different image formats. However, versions 1.1.7 and earlier of PIL, as well as Pillow before version 2.3.1, are vulnerable to a symlink attack. This vulnerability arises from the insecure handling of temporary files by the JpegImagePlugin.py and EpsImagePlugin.py scripts. By exploiting this vulnerability, local users can conduct symlink attacks by manipulating the names of temporary files on the command line.
Vulnerability Detail
The vulnerability in PIL and Pillow allows local users to perform symlink attacks by listing the processes. By manipulating the names of temporary files used by the JpegImagePlugin.py and EpsImagePlugin.py scripts, an attacker can create symbolic links to sensitive files or directories. This can lead to unauthorized access, data leakage, or even remote code execution if the attacker can control the content of the linked file or directory. The vulnerability has a moderate severity rating.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.1
This is the first release that contains the fix.
pip install --upgrade "pillow==2.3.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to a fixed version of the library.
Conclusion
The vulnerability in Python Image Library (PIL) and Pillow versions prior to 2.3.1 allows local users to conduct symlink attacks by manipulating temporary file names. Upgrading to the fixed versions of the library is recommended to mitigate this vulnerability. For further support and assistance, you can contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
PIL (Python Image Library) is an open-source library for image processing in Python. It provides various functions and methods for working with different image formats.
A symlink attack, also known as a symbolic link attack, is a type of security vulnerability where an attacker creates a symbolic link to a sensitive file or directory. By manipulating the link, the attacker can gain unauthorized access or perform malicious actions on the target system.
The vulnerability allows local users to conduct symlink attacks, which can lead to unauthorized access, data leakage, or remote code execution if the attacker can control the content of the linked file or directory.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance on fixing the vulnerability in your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
