CVE-2014-1933: Pillow - Symlink Attack Vulnerability
Summary
CVE-2014-1933: The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local... Affects pillow across 2 version ranges.
< 2.3.1
< 4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
Fixed in 4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7. How to fix ↓
Also tracked for
- pillow · Debian:11
The same CVE-2014-1933 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a Python Imaging Library (PIL) fork that provides support for opening, manipulating, and saving many different image file formats. It is widely used in Python applications for image processing and manipulation. However, versions 1.1.7 and earlier of PIL and Pillow before 2.3.1 are vulnerable to a symlink attack.
Vulnerability Detail
The vulnerability arises from the usage of temporary file names on the command line by the JpegImagePlugin.py and EpsImagePlugin.py scripts in PIL and Pillow. This flaw allows local users to exploit symlink attacks by listing the processes. By manipulating the temporary file names, an attacker can potentially overwrite or access sensitive files, leading to unauthorized access, data corruption, or other malicious activities.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
This is the first release that contains the fix.
pip install --upgrade "pillow==4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can minimize the risk by ensuring that the affected scripts are not executed with elevated privileges and by restricting access to the temporary file directories.
Conclusion
The vulnerability in Pillow versions 1.1.7 and earlier, and Pillow before 2.3.1, allows local users to conduct symlink attacks. To mitigate this risk, it is recommended to upgrade to Pillow version 2.3.1 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
This vulnerability allows local users to conduct symlink attacks, potentially leading to unauthorized access, data corruption, or other malicious activities.
Versions 1.1.7 and earlier of PIL and Pillow before 2.3.1 are affected by this vulnerability.
There are no known public exploits available for this vulnerability at the time of writing.
Yes, the vulnerability has been fixed in Pillow version 2.3.1. Users should update their Pillow installation to this version or later.
Users can minimize the risk by ensuring that the affected scripts are not executed with elevated privileges and by restricting access to the temporary file directories.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
