Teams that let Pillow touch user uploads have a reason to rebuild their images this week. Python’s most widely used imaging library shipped a fix for a command-execution path that turns a crafted filename into a shell, in a package downloaded an estimated 436 million times a month.
Tracked as CVE-2026-112900, the bug sits in EPS handling. Pillow hands the document name to Ghostscript, the program it invokes to rasterise that format, without validating the string first. Ghostscript can read an attacker-chosen name as instructions and follow it to a second file holding commands.
The picture itself is irrelevant. Per the advisory, only the name matters, so a harmless EPS still does damage when the uploader controls the filename. Endpoints that build a stored name from user input are the exposure.
Who is actually reachable
Exploitation also needs the gs binary, since Ghostscript must exist for Pillow to open EPS at all. Versions 2.6.0 through 12.3.0 carry the flaw. GitHub’s CVE record scores it 9.2; the maintainers say moderate, because the attacker must control the name.
Version 13.0.0, released October 16, spans four severity tiers. Alongside the EPS path it fixes a TIFF overflow present since 2013, reachable when a service re-encodes an upload to an in-memory buffer, and two JPEG bugs. One, CVE-2026-112403, trips on thumbnailing a crafted lossless JPEG; Anthropic found it with Claude, Ada Logics validated it by hand. The TIFF flaw, CVE-2026-112393, has a public proof of concept.
What to do this week
Upgrade to 13.0.0 and rebuild every container, wheel and base layer holding an older copy. The release drops Python 3.10, so those hosts need 3.11 or newer. Where upgrading waits, remove gs from hosts processing untrusted uploads, skip thumbnail calls on untrusted JPEGs, and treat in-memory TIFF writes as sensitive.
