Pillow Image Library Flaw Could Let Attackers Run Commands on Servers via a Crafted Filename

Pillow, the most widely used image library for Python, has a flaw (CVE-2026-112900) that can let an attacker run operating system commands on a server. The problem lies in how Pillow opens EPS images. It passes the file's name to Ghostscript, a separate program that turns the image into pixels, without checking the name first. Ghostscript can treat an attacker-chosen name as instructions rather than a file. The weakness is the filename, not the picture, so a harmless EPS file can still cause damage. Upload endpoints that build a stored file's name from user input are the realistic target.

The flaw only reaches Ghostscript on hosts that have the gs program installed. It affects Pillow from version 2.6.0 up to 12.3.0. The maintainers rate it moderate because the attacker must control the filename, while the CVE record assigned by GitHub rates it 9.2 out of 10. Pillow appears in web upload forms, avatar and thumbnail tools, document pipelines and most machine-learning projects, and OX Security estimates about 436 million downloads a month.

The fix arrived in version 13.0.0, released on October 16. This large security release also addresses two flaws the maintainers rate as critical: a memory bug involving stale image data, and two overflow flaws in JPEG decoding. One FlashPix (FPX) flaw was shown to run a command from a single call to Image.open() on a crafted file, if the optional olefile package is installed. None of the flaws is known to be under attack.