CVE-2022-24303: Improper Resolution of Path Equivalence

March 28, 2022 (updated November 7, 2023)

Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.

References

github.com/advisories/GHSA-9j59-75qj-795w
github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26
github.com/python-pillow/Pillow/pull/3450
nvd.nist.gov/vuln/detail/CVE-2022-24303
pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html

Detect and mitigate CVE-2022-24303 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →