Description
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pillow | 9.0.1-1 | — |
| Debian 13 | pillow | 9.0.1-1 | — |
| Debian 12 | pillow | 9.0.1-1 | — |
| Debian 11 | pillow | 8.1.2+dfsg-0.3+deb11u3 | DLA-4462-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | pillow | 9.0.1-1ubuntu0.1 | USN-5777-1 |
| Ubuntu 20.04 LTS | pillow | 7.0.0-4ubuntu0.7 | USN-5777-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | pillow-python2 | 6.2.1-3ubuntu0.1~esm1 | USN-5777-2 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Pillow | 9.0.1-1.1 | openSUSE-SU-2025:14645-1, openSUSE-SU-2024:11814-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-pillow | 9.0.1-r0 | — |
| Alpine v3.23 | py3-pillow | 9.0.1-r0 | — |
| Alpine v3.22 | py3-pillow | 9.0.1-r0 | — |
| Alpine v3.21 | py3-pillow | 9.0.1-r0 | — |
| Alpine v3.20 | py3-pillow | 9.0.1-r0 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | py3-pillow | 9.0.1-r0 | — |
| Alpine v3.18 | py3-pillow | 9.0.1-r0 | — |
| Alpine v3.17 | py3-pillow | 9.0.1-r0 | — |
| Alpine v3.16 | py3-pillow | 9.0.1-r0 | — |
| Alpine v3.15 | py3-pillow | 8.4.0-r3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pillow | < 9.0.1 | 9.0.1 | GHSA-9j59-75qj-795w |
Advisories 5
- USN-5777-1 pillow vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-5777-2 pillow-python2 vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:11814-1 python310-Pillow-9.0.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14645-1 python311-Pillow-11.1.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- DLA-4462-1 pillow - security update Debian Security (DSA / DLA) · Feb 1, 2026
References
- https://github.com/python-pillow/Pillow/pull/3450
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
- FEDORA-2022-ee15b98ea1 vendor-advisory
- FEDORA-2022-64332f2a7c vendor-advisory
- GLSA-202211-10 vendor-advisory