CVE-2022-22815

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 9.0.0

Description The issue is related to the path getbbox function in path.c in Pillow, which improperly initializes ImagePath.Path. This can be exploited by a remote attacker to access arbitrary files in the system by sending a specially crafted HTTP request. The vulnerability is associated with incorrect path restriction to the directory.

Recommendations For versions prior to 9.0.0, update to version 9.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the path getbbox function in path.c until a patch is available.