GHSA-pw3c-h7wp-cvhx · Severity: medium · Ecosystem: pip — Improper Initialization in Pillow
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.
Conclusion & alert: CVE-2022-22815 is rated Moderate Risk (57.5/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 2.56%). Core evidence: EPSS rose +2.46% over the last day, indicating growing attacker interest. Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.10% | 2.56% | +2.46% |
| 2 | 2025-11-21 | 0.95% | 0.10% | -0.85% |
| 3 | 2025-11-18 | — | 0.95% | — |
Full EPSS history (13 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 6.5 | 3.1 | MEDIUM |
|
3.9 | 2.5 | [email protected] |
| 6.4 | 2.0 | MEDIUM |
|
10.0 | 4.9 | [email protected] |
GHSA-pw3c-h7wp-cvhx · Severity: medium · Ecosystem: pip — Improper Initialization in Pillow
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
medium | CVE-2022-22815: 1 source package rows (py3-pillow); 7 state rows across 7 repos (3.17-community, 3.18-community, 3.19-community, 3.20-community, 3.21-community, 3.22-community, edge-community); fixed 7, open 0. | https://security.alpinelinux.org/vuln/CVE-2022-22815 |
debian
|
not yet assigned | CVE-2022-22815 not yet assigned priority: Debian including 1 source packages (pillow), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2022-22815 |
gentoo
|
high | CVE-2022-22815: 1 GLSA(s) (202211-10), 1 atom(s) (dev-python/pillow); latest impact high. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2022-22815 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2022-22815 |
suse
|
low | CVE-2022-22815 severity low: SUSE including 70 source package names (ardana-barbican-9.0+git.1644879908.8a641c1-3.13.1, grafana-6.7.4-3.26.1, …), 135 product×package rows across 18 product lines (HPE Helion OpenStack 8, SUSE Liberty Linux 8, … (18 product lines)): Fixed 111, Known Not Affected 21, Will Not Fix 3. | https://www.suse.com/security/cve/CVE-2022-22815/ |
ubuntu
|
medium | CVE-2022-22815 medium priority: Ubuntu including 3 source packages (pillow, pillow-python2, python-imaging), 45 status rows across 15 suites (bionic, focal, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 27, released 15, needs-triage 3. | https://ubuntu.com/security/CVE-2022-22815 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| python | pillow | < 9.0.0 | cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* |
| debian | debian_linux | 9.0 | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| debian | debian_linux | 10.0 | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| debian | debian_linux | 11.0 | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
| URL | Tags |
|---|---|
| https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331 | Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html | Mailing List Third Party Advisory |
| https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling | Vendor Advisory |
| https://security.gentoo.org/glsa/202211-10 | Third Party Advisory |
| https://www.debian.org/security/2022/dsa-5053 | Third Party Advisory |