Pillow EPS Bug Lets Crafted Images Trigger Server Command Execution
Pillow contains a critical vulnerability, CVE-2026-112900, in its handling of EPS images. The library passes a filename to Ghostscript without validating it, allowing an attacker to execute operating system commands on a server.
Pillow has a critical flaw tracked as CVE-2026-112900. The issue sits in how the library processes EPS image files. According to the available description, a filename is handed to Ghostscript without first being checked, creating a path for malicious input to influence that call.
Because the flaw can lead to operating system command execution on a server, it matters for systems that accept or process untrusted images. The available details do not specify affected versions, exploit conditions, or fixes, so those points remain unknown.
Servers that use Pillow to handle user-supplied EPS files could be at risk, and the consequences may extend to anyone whose data or services depend on those systems. If exploited, command execution could let an attacker operate with the server's privileges, potentially affecting availability, confidentiality, or trust in image-processing workflows. The practical impact may vary with exposure and configuration.