Pillow Flaw Enables Command Execution via an Attacker-Controlled Filename
Summary
Pillow versions 2.6.0–12.3.0 have an EPS filename-handling flaw that can pass attacker-controlled input to Ghostscript and enable command execution. Pillow 13.0.0 fixes this and other security flaws.
Key points
- CVE-2026-112900 affects Pillow 2.6.0–12.3.0: an attacker-controlled EPS filename can be interpreted by Ghostscript as instructions, potentially enabling operating-system command execution.
- The EPS issue requires Ghostscript to be installed and is most relevant to upload workflows that retain or construct filenames from user input.
- A separate FlashPix flaw can execute an attacker's command when opening a crafted file if the optional olefile package is installed.
- Other disclosed flaws include memory overflows in JPEG thumbnail generation and in-memory TIFF saving; the TIFF issue was reportedly escalated to code execution only with a separate memory-address disclosure flaw.
- The maintainers rated the EPS flaw moderate, while its GitHub-assigned CVE record rates it 9.2; the article reports no known exploitation of the EPS flaw and a public proof of concept for the TIFF flaw.
- Pillow 13.0.0 fixes the disclosed flaws. The article recommends rebuilding containers and other images bundling older copies; Pillow 13 also requires Python 3.11 or newer.
Article Details
- Vulnerability Types
- Command execution via an attacker-controlled EPS filename
- Memory buffer overflow in JPEG decoding
- Memory buffer overflow when saving compressed TIFF images to memory
- Stale image data reused after a mode change
- Severity
- Ratings vary: Pillow maintainers rate the EPS flaw moderate; the article reports critical-tier fixes and CVE-record scores of 9.2/10 for the EPS, TIFF, and JPEG-thumbnail flaws.
- Affected Versions
- Pillow 2.6.0 through 12.3.0
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-112393A third flaw, CVE-2026-112393, has been in Pillow since 2013. It overflows a memory buffer when a program saves a compressed TIFF image to memory rather than to a file on disk, the common pattern for a service thatCVE-2026-112403The other, CVE-2026-112403, overflows a memory buffer when a program makes a thumbnail of a crafted lossless JPEG. Its advisory reports a crash, not code execution. The bug was "found by Anthropic using Claude to studyCVE-2026-112900The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.
Products
GhostscriptThe flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.olefilerun an attacker's command from a single call to Image.open() on a crafted file, as long as the optional olefile package is installed. Pillow recognizes these files by their content, not their extension, so a serverPillowPillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open.