Critical Pillow Flaw Turns a Filename Into Command Execution

Pillow is the most widely used image library in Python, turning up nearly everywhere: upload forms, avatar and thumbnail tools, document and PDF pipelines, and most machine-learning projects. OX Security, the firm whose report drew attention to the problem, estimates it is downloaded about 436 million times a month.

The danger is in the filename

The flaw, CVE-2026-112900, lies in how Pillow handles EPS images. To render such a file into pixels, Pillow runs a separate program, Ghostscript, and passes it the file's name without checking it first. Ghostscript can read an attacker-chosen name as instructions rather than as a file, pointing it at a second file carrying commands to run.

The key detail: according to the advisory, the filename triggers the flaw, not anything in the document. Even a harmless EPS file can cause damage if an attacker controls its name. The realistic target is upload endpoints that keep or build a stored file's name from user input. The attack only reaches Ghostscript on hosts where the gs program is installed. Versions from 2.6.0 up to 12.3.0 are affected.

The maintainers rate the severity moderate, because the attacker must control the filename. The CVE record assigned by GitHub scores it 9.2 out of 10 and flags the same condition.

A large security release

Version 13.0.0, released October 16, fixes several flaws across severity levels. Two are marked critical. One is a memory bug — stale image data reused after a mode change. The other covers overflow flaws in JPEG decoding. One of them, in the FlashPix format, was shown to run an attacker's command from a single Image.open() call on a crafted file, provided the optional olefile package is installed. Pillow recognizes such files by content, not extension, so a server can be hit with no user action.

CVE-2026-112403 overflows a buffer when making a thumbnail from a crafted JPEG; here the report describes a crash, not code execution. It was found by Anthropic using Claude to study open-source security and validated manually by Ada Logics. A further flaw, CVE-2026-112393, has existed in Pillow since 2013 and overflows a buffer when saving a compressed TIFF to memory rather than to disk.

What to do

Upgrade to Pillow 13.0.0 and rebuild any containers, wheels, or base images that bundle older copies. Pillow 13 drops Python 3.10, so installs on it need Python 3.11 or newer. Until then, keep gs off hosts that process untrusted uploads, avoid draft() and thumbnail() on untrusted JPEGs, and treat saving a TIFF to an in-memory buffer as a sensitive path.

Source: The Hacker News