Pillow Flaw Could Turn Image Filenames Into Code Execution

A file's name, rather than its contents, can expose Python applications to command execution through a recently patched Pillow vulnerability.

Tracked as CVE-2026-112900, the flaw affects how Pillow passes Encapsulated PostScript (EPS) filenames to Ghostscript for image processing. Pillow 13.0.0, released October 16, 2026, fixes the vulnerability and two related memory-corruption issues involving TIFF and JPEG files.

Applications processing untrusted EPS files are potentially exposed when attackers can influence filenames passed to Ghostscript. A successful attack could execute commands with the permissions of the affected process, although exploitation requires additional conditions.

How the Pillow flaw enables code execution

The Pillow security advisory identifies versions 2.6.0 through 12.3.0 as affected. The vulnerability occurs in PIL.EpsImagePlugin.Ghostscript(), which passes filenames to Ghostscript without adequately handling characters interpreted as command-line arguments.

Filenames beginning with a hyphen can be interpreted as Ghostscript command-line options rather than file paths. Ghostscript also supports @ argument files, which can supply additional options. An attacker who controls the relevant filename and referenced argument file could exploit these behaviors to execute commands.

Security researcher Chanu Kang of KAIST's CysecLab demonstrated command execution despite Ghostscript's default -dSAFER protection. The exploit requires Ghostscript, EPS processing, attacker influence over the filename and control of the referenced argument file.

The GitHub Advisory Database assigns CVE-2026-112900 a Critical CVSS 4.0 score of 9.2, while Pillow's maintainers rate it Moderate.

Recent NGINX security vulnerabilities also required administrators to examine specific configurations alongside affected software versions.

Pillow 13.0.0 also addresses two memory-corruption vulnerabilities:

• CVE-2026-112393: A TIFF heap-buffer overflow involving certain compressed TIFF files saved to in-memory objects, potentially causing memory corruption or information disclosure.
• CVE-2026-112403: A JPEG decoding flaw affecting specially crafted lossless images processed through draft() or thumbnail() with certain libjpeg configurations. Crashes and potential code execution are among the risks.

Exposure checks and mitigation priorities

Security teams should inventory Pillow installations across applications, containers and dependencies, then identify workloads processing untrusted EPS files. Ghostscript availability and filename handling determine exposure to CVE-2026-112900.

The same exposure-based approach informs October's vulnerability patch prioritization, where installed components and exploitability influence remediation decisions.

Organizations should take these steps:

• Upgrade Pillow: Deploy version 13.0.0 or later and rebuild affected containers.
• Audit Ghostscript: Identify EPS-processing workloads that preserve attacker-controlled filenames.
• Restrict file handling: Disable unnecessary formats and normalize filenames before invoking external tools.
• Isolate processing services: Use sandboxing and least-privilege accounts to limit potential damage.
• Review related workflows: Check compressed TIFF encoding and lossless JPEG downscaling configurations.
• Investigate anomalies: Examine unexpected Ghostscript subprocesses, unusual crashes and suspicious file-processing activity.
• Test incident response plans: Verify containment, evidence preservation and recovery procedures.

Recent SiteGuard command-injection exploitation highlights the importance of preserving forensic evidence before remediation when compromise is suspected.

The Pillow 13.0.0 release notes confirm the fixes and the removal of Python 3.10 support. As of October 26, GitLab reported that affected Pillow packages in several Debian and SUSE distributions still lacked fixes, while Amazon Linux packages were awaiting updates. Organizations should check distribution-specific advisories and runtime compatibility before deployment.

Until affected environments are patched, restricting EPS processing and isolating image-handling services can reduce the likelihood and potential impact of exploitation.

Also read: For additional context on remediation priorities, Microsoft's September security updates illustrate how confirmed exploitation can change the order in which vulnerabilities need attention.