-
A flaw in Pillow’s filename handling can let attackers run operating system commands when certain conditions are met.
-
Pillow 13.0.0 fixes this flaw and several other security problems that affect image processing.
-
Developers should update their setups and review any system that handles image uploads from untrusted sources.
Python developers have been told to update Pillow, a popular software toolkit for working with images. Researchers shared details of several security flaws in the toolkit. Some of them can let attackers run commands or damage a computer’s memory.
The flaws affect apps that use Pillow to open, resize, convert, or save images. These apps include website upload services, thumbnail makers, and document tools. Any of them could face risk when they handle files from untrusted sources.
Odd Filenames Open a Path to Command Execution
One flaw carries the tracking number CVE-2026-112900. It involves the way Pillow passes Encapsulated PostScript (EPS) filenames to Ghostscript. Ghostscript is a separate program that Pillow uses to draw these images.
According to Pillow’s official security advisory, the toolkit does not handle some filenames safely. It passes them to Ghostscript as they are. A specially crafted name can then be read as a command-line option. That is an order typed to a program.
The flaw affects Pillow versions from 2.6.0 up to, but not including, 13.0.0. The project released version 13.0.0 on October 16, 2026, and it contains the fix. The release notes list the changes.
GitHub’s advisory rates the flaw as critical. Pillow’s maintainers call it moderate. The ratings differ because each source judges the danger in its own way. They also weigh the conditions for an attack differently.
The problem starts because Pillow does not block special characters in a filename. A filename that begins with a hyphen can be treated as an option. Ghostscript also has a feature that loads extra orders from another file.
An attacker who controls the filename and the contents of that file can link these steps together. The result can run operating system commands with the same permissions as the affected program. The attack does not need harmful code hidden inside the image itself.
Still, a crafted filename alone does not work in every case. The documented attack chain needs extra conditions. Ghostscript must also be installed on the system, because Pillow relies on it to process EPS images. The risk matters most for apps that accept untrusted files and let users shape the saved filenames.
Security researchers at OX Security reported the issue as part of a wider review of Pillow bugs. The company estimates that Pillow gets about 436 million downloads each month. That number shows how widely Python developers use the toolkit. It is only the researchers’ estimate, and not an independently checked count of users or installations. The company explains its findings in a blog post.
Two More Memory Bugs Hit JPEG and TIFF Handling
The update also fixes weaknesses in other parts of Pillow’s image code. One critical flaw, CVE-2026-112403, involves a heap buffer overflow during JPEG decoding. This kind of bug happens when data spills past the memory space set aside for it. The same OX Security blog post covers this JPEG flaw.
The problem can appear when an app runs draft() or thumbnail() on a specially crafted lossless JPEG image. Depending on the processing setup, the memory damage can crash the app. It may also allow attackers to run code.
Another flaw, CVE-2026-112393, affects compressed TIFF images that Pillow saves to in-memory buffers, such as Python’s io.BytesIO. Researchers reported that it can also cause a heap buffer overflow. Exploitation may crash the process. Running code needs additional circumstances.
Pillow 13.0.0 also fixes other security defects. One critical issue involves old image storage that the toolkit reuses after an image mode changes. Pillow’s release notes cover all changes in version 13.0.0. These findings show why image tools need careful security testing, especially when they handle files from outside users.
The reports do not show that attackers are using these flaws right now. They describe the technical weaknesses and their possible harm. The cited sources have not confirmed widespread attacks.
Pillow Maintainers Urge Developers to Upgrade
Pillow’s maintainers recommend updating to version 13.0.0 or later. Administrators should also rebuild containers and deployment images that bundle older versions of the toolkit. The upgrade needs one extra check. Pillow 13.0.0 drops support for Python 3.10. Projects that use that version must move to Python 3.11 or newer before they upgrade.
Some teams cannot patch right away. For now, they should avoid processing untrusted EPS files on systems with Ghostscript, unless necessary. They should also keep user-controlled filenames away from the weak EPS paths. They should review the documented workarounds for the JPEG and TIFF flaws as well.
Apps that process uploaded images automatically deserve special attention. A weak library can expose servers to attacks through ordinary file handling. Updating Pillow, checking indirect dependencies, and limiting untrusted files all help reduce the risk.
Data security risks also extend beyond software vulnerabilities, as Turkish Cypriot authorities have investigated an alleged data leak affecting 364,000 people. Teams should check any other tools that quietly rely on Pillow.
