CVE-2022-24303: Path Traversal
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-24303?
CVE-2022-24303 is a vulnerability in Pillow before version 9.0.1 that allows attackers to delete files due to mishandling of spaces in temporary pathnames.
What is the severity of CVE-2022-24303?
CVE-2022-24303 has a severity rating of 9.1, which is considered critical.
How does CVE-2022-24303 affect Pillow?
CVE-2022-24303 affects Pillow versions up to but excluding version 9.0.1.
How can I fix CVE-2022-24303?
To fix CVE-2022-24303, you should update Pillow to version 9.0.1 or later, which contains the necessary remedy for this vulnerability.
Where can I find more information about CVE-2022-24303?
You can find more information about CVE-2022-24303 in the National Vulnerability Database (NVD) at https://nvd.nist.gov/vuln/detail/CVE-2022-24303. Additionally, you can refer to the GitHub commit at https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26 and the release notes at https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security.