CVE-2014-1932: Pillow - Insecure Temporary File Creation
Summary
CVE-2014-1932: The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlie... Affects pillow across 2 version ranges.
< 2.3.1
< 4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
Fixed in 4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7. How to fix ↓
Also tracked for
- pillow · Debian:11
The same CVE-2014-1932 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library for image processing and manipulation. It provides a wide range of functions and supports various image file formats. However, versions 1.1.7 and earlier of Pillow, as well as Pillow before version 2.3.1, are vulnerable to insecure temporary file creation.
Vulnerability Detail
The vulnerability arises from the improper creation of temporary files in several functions of the Pillow library. Specifically, the 'load_djpeg' function in 'JpegImagePlugin.py', the Ghostscript function in 'EpsImagePlugin.py', the 'load' function in 'IptcImagePlugin.py', and the '_copy' function in 'Image.py' are affected. This flaw allows local users to exploit a symlink attack on the temporary file, leading to arbitrary file overwriting and potential exposure of sensitive information.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
This is the first release that contains the fix.
pip install --upgrade "pillow==4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Pillow is not immediately feasible, users can employ the following workaround to mitigate the vulnerability:
Avoid using the affected functions or features that trigger the creation of temporary files. Additionally, ensure that the application running Pillow has appropriate file system permissions to prevent unauthorized access or overwriting of files.
Conclusion
The vulnerability in Pillow versions 1.1.7 and earlier, as well as Pillow before version 2.3.1, allows local users to exploit insecure temporary file creation. To mitigate this issue, it is recommended to update Pillow to version 2.3.1 or later. Alternatively, users can follow the provided workaround and take necessary precautions. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python library for image processing and manipulation. It provides various functions and supports multiple image file formats.
Versions 1.1.7 and earlier of Pillow, as well as Pillow before version 2.3.1, are vulnerable to this issue.
The vulnerability allows local users to overwrite arbitrary files and potentially access sensitive information through symlink attacks on temporary files.
To fix this vulnerability, update Pillow to version 2.3.1 or later using the 'pip install --upgrade pillow' command.
If updating Pillow is not immediately possible, users can mitigate the vulnerability by avoiding the use of affected functions or features that trigger the creation of temporary files. Additionally, ensure proper file system permissions to prevent unauthorized access or file overwriting.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
