CVE-2022-24303: Path traversal in Pillow – CVSS 9.1 · Watchpost

← All vulnerabilities

Path traversal in Pillow

심각 9.1CVE-2022-24303 · BIT-pillow-2022-24303 · GHSA-9j59-75qj-795w · Published 28/03/2022 · updated 17/06/2026

요약

CVE-2022-24303은(는) pillow, pillow (python)에 영향을 주는 심각 (CVSS 9.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 2.7%, 전체 취약점의 85.9%보다 높음.
조치: 9.0.1 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
pillow PyPI	`< 9.0.1`	`9.0.1`
pillow python	`< 9.0.1`	`9.0.1`

Description

Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.

NVD description

Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.

References

nvd.nist.gov/vuln/detail/CVE-2022-24303 · ADVISORY
python-pillow/Pillow#3450 · WEB
python-pillow/Pillow#6010 · WEB
python-pillow/Pillow commit 10c4f75 · WEB
python-pillow/Pillow commit 1430321 · WEB
python-pillow/Pillow commit 427221e · WEB
GitHub Advisory GHSA-9j59-75qj-795w · ADVISORY
pypa/advisory-database · WEB
python-pillow/Pillow · PACKAGE
python-pillow/Pillow · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV

pillow의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free