CVE-2022-24303: Pillow before 9.0.1 File Deletion Vulnerability
Summary
CVE-2022-24303: Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. Affects pillow versions < 9.0.1. Fixed in 9.0.1. How to fix ↓
Also tracked for
- pillow · Bitnami
- py3-pillow · Alpine:v3.15
The same CVE-2022-24303 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library for image processing and manipulation. It provides a wide range of functions and supports various image file formats. However, prior to version 9.0.1, Pillow mishandles spaces in temporary pathnames, which can be exploited by attackers to delete files.
Vulnerability Detail
The vulnerability in Pillow before 9.0.1 arises from the improper handling of spaces in temporary pathnames. Attackers can leverage this flaw to delete files on the system. By manipulating the temporary pathnames, an attacker can trick the application into deleting arbitrary files, potentially leading to data loss or unauthorized access.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.0.1
This is the first release that contains the fix.
pip install --upgrade "pillow==9.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the patched version of Pillow to mitigate the risk of file deletion.
Conclusion
The vulnerability in Pillow before 9.0.1 allows attackers to delete files on the system by exploiting the mishandling of spaces in temporary pathnames. To mitigate this risk, it is crucial to update Pillow to version 9.0.1 or later. Failure to do so may result in data loss or unauthorized access. For additional support and guidance, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
This vulnerability allows attackers to delete files on the system, potentially leading to data loss or unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it in real-time.
At the time of this advisory, there are no known public exploits targeting this specific vulnerability. However, it is still crucial to update to the patched version to prevent potential attacks.
No, the only way to mitigate the risk is to update Pillow to version 9.0.1 or later. This version includes the necessary fix to properly handle spaces in temporary pathnames.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
