Launchpad.net

CVE 2022-24303

Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.

See the CVE page on Mitre.org for more details.