CVE-2022-24303: Fedoraproject Fedora

Critical severity, CVSS 9.1. EPSS: 2.7% chance of exploitation in the next 30 days.

Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.

Affected products

• Fedoraproject Fedora: version 34 only; version 35 only
• Python Pillow: before 9.0.1 (fixed in 9.0.1)

Published 2022-03-28. Last modified 2026-06-17.