Python Pillow Flaw Lets Attackers Run Code via Just a Filename
Security researchers have uncovered a critical remote code execution vulnerability in Pillow, the foundational image-processing library for Python. Tracked as CVE-2026-112900, the flaw allows arbitrary shell commands to run on underlying servers simply by passing a maliciously crafted filename to an external Ghostscript process.
Command execution via filenames: Inside CVE-2026-112900
Pillow is ubiquitous across the Python ecosystem, serving as the default tool for resizing, cropping, and converting user-submitted images in thousands of web services. The security breakdown happens when the library encounters Encapsulated PostScript (EPS) files and delegates rendering tasks to an installed Ghostscript binary.
Instead of sanitizing the incoming EPS file path, Pillow relays user-controlled filenames straight to the command-line interface of the Ghostscript subprocess. That oversight turns a standard file upload into a command injection vector. Even if the file itself is a harmless graphic, a specially crafted filename containing shell metacharacters will trigger code execution at the privilege level of the application worker.
Which systems are exposed and how to mitigate the flaw
Any web platform that accepts user images—such as profile pictures, document scans, or storefront product photos—and feeds them into Pillow for format checking or normalization is at risk. Much like the architectural traps exposed by a critical PHP vulnerability bridging system boundaries, relying on underlying system utilities without strict isolation often compromises the host server entirely.
Engineering teams should implement two immediate defenses. First, disable EPS format parsing entirely if your application workflow has no genuine requirement for PostScript rendering. Second, never trust user-supplied filenames on disk: upload handlers should generate randomized strings like UUIDs immediately upon receipt and pass only those sanitized internal identifiers to background processors.
Finding another argument injection flaw that bridges a modern Python stack to an old-school C binary like Ghostscript feels like deja vu. The core design failure remains trusting user input where internal paths belong. If your upload pipeline saves files using the original client-provided name before doing sanitation, your application is asking for trouble.
Availability and remediation advice
Any server running Django, Flask, FastAPI, or Celery pipelines that process user uploads using default Pillow installations should be audited immediately. Security teams across US, UK, and EU infrastructure should inspect upload endpoints for EPS support and strip Ghostscript from container images where document rendering is not required.
Image-processing stacks remain one of the most volatile attack surfaces on the modern web. Until patch releases propagate across standard package indices, isolating workers and stripping external tools like Ghostscript is the most reliable defense.
Frequently asked questions
How does the Pillow vulnerability trigger remote code execution?
Attackers embed shell commands inside the filename of an EPS graphic. When Pillow delegates that file to Ghostscript on the command line without escaping, the operating system executes the embedded payload.
Does validating file contents protect against CVE-2026-112900?
No. The vulnerability is triggered by the filename argument itself, not the content of the image. Even a completely valid EPS file with a malicious filename will execute arbitrary commands.
Sources
- Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image. t.co, 2026. https://t.co/WgsQv9TroW
- Python Pillow Kütüphanesinde Kritik Açık: Dosya Adı ile Kod Yürütme Riski (CVE-2026-112900). @TheHackersNews, 2026. https://x.com/TheHackersNews/status/2113565218039333137