Pillow flaw can turn crafted filenames into code execution
A Pillow vulnerability can turn an attacker-controlled filename into operating-system instructions when EPS images reach Ghostscript.
A security flaw in Pillow, the widely used Python image-processing library, can let an attacker turn a filename into operating-system instructions when a server opens an EPS image through Ghostscript.1
The issue is tracked as CVE-2026-112900. According to The Hacker News, the weakness is not in the picture itself: it is triggered by the filename passed to Pillow. Ghostscript can interpret a name supplied by an attacker as instructions and use it to point at a second file containing commands.1
That makes the realistic risk less about someone opening a malicious-looking image on a desktop and more about services that accept uploads, retain user-controlled names and process images automatically. Web upload forms, avatar generators, thumbnail services, document pipelines and machine-learning systems are all common places where Pillow appears.1
The fix is Pillow 13.0.0
Pillow's maintainers released version 13.0.0 on October 16, and the release includes security fixes across several severity levels.12 The report says the EPS/Ghostscript issue affects Pillow from version 2.6.0 through 12.3.0, and only reaches Ghostscript on systems where that separate program is installed.1
The release also addresses other image-handling problems. The maintainers' notes list critical fixes for stale native image storage and JPEG decoder buffer overflows, alongside high-severity issues affecting formats and operations including WMF/EMF, TIFF, PDF and Exif processing.2 The exact impact depends on the format being handled and the way an application calls Pillow, so the safest response is to upgrade rather than assume an unused file type makes an installation harmless.
Pillow 13.0.0 drops Python 3.10, meaning deployments still on Python 3.10 or older need to plan a Python upgrade as well.1 The project describes Pillow as a maintained successor to the original Python Imaging Library and says it is used across more than two million repositories and 30,000 packages.3
What developers should do
Upgrade with the project’s supported package path, then rebuild containers, wheels and base images that may carry an older copy:
`pip install -U "Pillow>=13.0.0"`
Teams that cannot upgrade immediately should follow Pillow's security guidance and the individual advisories. For the EPS path, that means keeping Ghostscript away from hosts that process untrusted uploads where possible and never passing an attacker-controlled filename to `Image.open()` for EPS. The report also identifies safer handling steps for crafted JPEG thumbnails and TIFF data written to in-memory buffers.1
The flaw is not reported as being under active attack, but that should not be mistaken for a low-priority dependency update. Image libraries sit beneath many products, and a vulnerable parser can be reached indirectly by an upload or conversion feature that users do not think of as security-sensitive.
Our opinion
Pillow is exactly the sort of dependency teams can overlook because it works quietly in the background. This disclosure is a useful reminder that the filename, parser and external helper can matter as much as the image bytes. The practical answer is refresh the dependency, rebuild every packaged environment and audit upload paths that preserve user-controlled names. Waiting for evidence of exploitation is a poor trade when the fixed release is already available and the vulnerable code may be buried in a service nobody associates with image security.