Pillow is the image library most Python web applications end up using, whether the developer chose it or a framework did. It opens, converts, crops and re-encodes images. It also, for certain formats, delegates work to command-line tools. The October 2026 advisory covers several defects, and one of them is a reminder that "process this image" can become "run this command" when a filename reaches a subprocess.

What was disclosed

The published reporting identifies at least three items, addressed by upgrading to Pillow 13.0.0:

  • CVE-2026-112900, command execution through crafted filenames passed into the EPS handling path. Pillow's EPS support relies on external tools, and a filename that is not validated can be interpreted by the shell that invokes them.

  • CVE-2026-112393, a buffer overflow in compressed TIFF handling when the compressed image is written to memory rather than to disk. This is the pattern used by services that re-encode an upload and return the bytes.

  • A third flaw in the same release, described as long-standing, with the same general shape: image input that reaches memory the application did not intend it to reach.
    The distinction between the first two matters for exploitation. The command execution item needs a filename that an attacker can influence; the TIFF item needs an upload that passes through an in-memory conversion step. Both are common in exactly the applications that process user images at scale.

Why a filename becomes a command

EPS and PostScript are not raster formats. Rendering them requires an interpreter, and Pillow's approach has historically been to call out to Ghostscript. Once a library builds a command line, the question is how it quotes what it was given. A file called report.eps is safe. A file whose name contains shell metacharacters is not, if the name is concatenated into a command string.
The precondition is the interesting part. An application that writes uploads to a server-generated path and then opens that path is not exposed to the filename variant, because the attacker's chosen name never reaches the tool. An application that opens the uploaded file by its original name, or that passes a user-provided path into Pillow's save or open call, is. That difference is a code property, not a configuration setting, and it is invisible to a scanner that only reports the library version.
The TIFF item is the opposite. It does not care about names. It cares whether the compressed image data is written to a memory buffer, which is what happens when a service wants to return the re-encoded image without touching the disk.

Finding the exposure in a real codebase

Three greps cover most of the ground. First, calls that pass a user-derived string into an image open or save operation. Second, uses of the in-memory buffer pattern on compressed output. Third, any place where the application hands a filename to an external tool.
Then check the delegation policy. Pillow's EPS path can be restricted, and a service that does not accept PostScript has no reason to keep the capability. Removing an unused decoder is more durable than adding an input filter in front of it.
For the TIFF path, the mitigation short of upgrading is to bound the work: downscale before re-encoding, cap dimensions from the header before decoding, and run the conversion in a process with memory and CPU limits. None of that removes the bug, but it changes what a crafted file can achieve.

The upgrade itself

Pillow 13.0.0 is the fixed release for these items. The complication is that Pillow is frequently a transitive dependency, pulled in by a framework for thumbnail generation and never listed in the project's own requirements. The version that matters is the one the running process imports, so a check against the deployment environment beats a check against the lock file, particularly where an OS package provides Pillow alongside a virtual environment that has a different copy.
Applications that bundle Pillow inside a container image inherit the base image's version. Rebuilding on a patched base is part of the fix, and it is the step most likely to be missed when the application's own dependency file was updated.

A concluding rule for image handling

Image processing is an input parsing problem in front of an execution problem. Treat uploaded files as untrusted binaries, generate your own filenames and paths, disable decoders you do not use, and run conversions with resources capped. None of those is specific to Pillow, and all of them reduce the value of the next library advisory in this category.

References

  • Pillow 13.0.0 release and security advisory covering CVE-2026-112900 and CVE-2026-112393

  • FreeBuf summary of the Pillow October 2026 fixes, including the EPS filename command execution path and the compressed TIFF in-memory overflow

  • 51CTO security coverage of the same release