Pillow EPS flaw lets attacker-named files reach Ghostscript (CVE-2026-112900)

Pillow, the imaging library a large slice of the Python ecosystem depends on, shipped 13.0.0 on October 16 with fixes for four memory- and command-safety bugs. The headline issue is CVE-2026-112900, an argument-injection flaw in the EPS loader that can reach remote code execution through Ghostscript. Details and the fix are in the GitHub advisory GHSA-w889-685w-c8fh and the 13.0.0 release notes; The Hacker News reported it the same week.

What the bug does

PIL.EpsImagePlugin.Ghostscript() builds the Ghostscript command line from the input file path without sanitizing it. Per the advisory, a filename starting with - is parsed by Ghostscript as an option, and a filename starting with @ is read as an argument file — so an attacker who controls the name passed to Image.open() can inject Ghostscript arguments and point it at a second, attacker-staged file of commands. Ghostscript's default -dSAFER sandbox does not stop this. The advisory reports the chain can lead to code execution.

The caveat matters: exploitation requires that the application lets an attacker control the filename (not just the file contents), and that the gs binary is installed on the host. The GitHub CVE record scores it 9.2, but the maintainers rate it moderate for that reason.

Affected and fixed

• Affected: Pillow 2.6.0 through 12.3.0.
• Fixed: 13.0.0. The suggested fix is wrapping the filename in os.path.abspath() before it reaches Ghostscript.

The other three in 13.0.0

• FPX decode overflow (GHSA-5x8w-8jj5-q52h) — a FlashPix path overflow reachable from a single Image.open() if the optional olefile package is installed. Code execution.
• CVE-2026-112403 — buffer overflow in lossless-JPEG thumbnail handling. Crash only, not code execution.
• CVE-2026-112393 — buffer overflow saving a compressed TIFF to memory, present since 2013. Code execution needs a second memory-leak bug; saving to a disk file is unaffected. CISA lists a public PoC for this one.

Exploitation status

None of the four is known to be exploited. CISA shows no known-exploited entry for the EPS flaw; the only public PoC is for the TIFF-to-memory bug.

Action checklist

1. Upgrade to Pillow 13.0.0 across services, workers and container base images. Pin it in requirements.txt / pyproject.toml and rebuild.
2. Audit where user input reaches a filename, not just file bytes — upload handlers, thumbnailers, and any pipeline that names a temp file from client-supplied data are the EPS flaw's real surface.
3. If you don't need EPS, drop Ghostscript from the image. No gs binary, no CVE-2026-112900 path.
4. Check for olefile in environments that open untrusted images; its presence turns the FPX bug into a code-execution path.

Context

This is the recurring shape of Pillow risk: the bug is rarely in Pillow's own pixel code but in how it hands data to an external tool or an optional dependency — Ghostscript here, olefile for FPX. Pillow sits under Django image fields, PDF and thumbnail pipelines, and ML preprocessing, so "attacker controls a filename" is a more common precondition than it sounds. Treat the upgrade as a dependency-floor bump, not a single-service patch.