Security updatesPillow

Pillow fixes EPS filename handling vulnerability: image upload services should check for updates

Pillow's official advisory says EPS image filename handling could incorrectly treat filenames as program arguments, leading to code execution under certain conditions. Version 13.0.0 fixes the issue. Teams operating image upload and conversion services should check their actual versions.

Anti-Ransomware · Compiled with SI agent assistanceOfficial security advisory: 2026-10-17; patched version released: 2026-10-16:Checked 2026.10.26
Original synthetic illustration of a stationery shop owner checking incoming print artwork
Illustration · Source ↗ · About this image ↗

Source Facts

Pillow is an image processing component widely used in Python applications. Its official 17 October advisory lists CVE-2026-112900, affecting versions 2.6.0–12.3.0, with a fix in 13.0.0.

The issue occurs when processing EPS images and invoking Ghostscript. If an attacker controls the relevant filename and files needed to chain the attack, the service may execute unintended code. This does not mean all image formats or every image viewer face the same risk.

The official advisory rates this issue Moderate; this site follows the stated applicability conditions. Version 13.0.0 also includes compatibility changes, so test website uploads, thumbnails and conversion workflows before updating.

Next Steps for Businesses / Editorial Observations

Check filenames and conversion components as well as file contents

Next steps you can take

  • Confirm whether image processing services use Pillow and EPS functions, and upgrade to a patched version within the supported scope.
  • Validate file-conversion workflows in a test environment, restrict service permissions and check for unusual execution activity.

Original sources

Reporting leads · The Hacker News

The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.

Argument Injection in Ghostscript call, potentially leading into RCE

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxOriginal scenario illustration of office colleagues checking computer updates and a maintenance checklistIllustrationSecurity updates · 2026.10.25

Emergency .NET update supplies a previously omitted fix: check Windows application versions again

Microsoft .NETIllustration of a female bakery owner checking online orders and receiptsIllustrationVulnerability advisories · 2026.10.25

PHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause

PHP / Palo Alto Networks Unit 42