Critical flaw in Python’s Pillow library let attackers run code via image uploads

How the flaw works

A critical vulnerability in Pillow, the most widely used image library for Python, let attackers run operating system commands on a server by uploading an image file with a specially crafted name. The flaw, tracked as CVE-2026-112900, was in the way Pillow handled Encapsulated PostScript (EPS) images. When Pillow opened an EPS file, it passed the filename to Ghostscript, a separate program used to turn the image into pixels. Pillow did not check the filename first. If an attacker controlled the filename, Ghostscript could interpret it as instructions, not just a file name, and run commands from another file chosen by the attacker. This made it possible to execute code on the server simply by uploading a file with a malicious name, according to The Hacker News↗ (opens in a new tab).

The flaw only affected servers with Ghostscript installed. Pillow needs Ghostscript to open EPS images at all. The issue affected Pillow from version 2.6.0 up to 12.3.0. It was fixed in version 13.0.0, released on 16 October 2026.

Who is affected

Pillow is used in many Python projects that handle images, such as web upload forms, avatar and thumbnail tools, document and PDF pipelines, and machine learning projects. OX Security estimates it is downloaded about 436 million times a month. Any service that lets users upload images and keeps or builds a filename from user input could be at risk if it uses Pillow to process EPS files and has Ghostscript installed.

The response

Pillow’s maintainers released version 13.0.0 to fix the flaw. This release also patched other critical issues, including memory bugs in JPEG and TIFF handling. The maintainers rated the EPS flaw as moderate, because the attacker must control the filename. However, the CVE record assigned by GitHub rates it 9.2 out of 10 (critical). There is no evidence the flaw has been exploited in the wild.

The maintainers and advisories recommend upgrading to Pillow 13.0.0 and rebuilding any containers or images that include an older version. Pillow 13 drops support for Python 3.10, so users must be on Python 3.11 or newer to upgrade.

What you should do

If you run a service that processes user-uploaded images with Pillow, upgrade to version 13.0.0 as soon as possible. Until you can upgrade, do not install Ghostscript on hosts that handle untrusted uploads, and never pass user-controlled filenames to Image.open() for EPS files. Review your upload endpoints to ensure filenames are not taken directly from user input. For JPEG and TIFF issues, follow the security guidance in the release notes to avoid risky code paths.

No primary source or vendor advisory has been published yet. The flaw is only reported by The Hacker News, citing OX Security and GitHub advisories. No one has reported real-world exploitation.