Pillow CVE-2026-112900

Requires the host application to pass an attacker-controlled filename into Pillow's EPS code path (EpsImagePlugin.Ghostscript) with Ghostscript installed. Argument injection requires only a filename beginning with '-' (interpreted as a Ghostscript option). Escalation to arbitrary command execution specifically requires a filename beginning with '@' (a Ghostscript argument-file token) AND attacker control of the contents of that referenced text file; the reported chain works even with the default -dSAFER invocation. Limiting factors: the application must not sanitize or re-root the filename before handing it to Pillow, Ghostscript must be present, and full RCE needs the secondary attacker-controlled argument file - plain argument injection is easier but the command-execution outcome is gated by these preconditions. Not exploitable in versions >=13.0.0 (filename is made absolute).

This is a genuine high-priority issue for applications that feed untrusted filenames into Pillow's EPS handling, but its real-world risk is more nuanced than the 9.2 CVSS 4.0 score suggests. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC:H/VI:H/VA:H) models network reach, no privileges, and no user interaction, but the AT:P (Attack Requirements: Present) flag is doing heavy lifting - it reflects that full command execution is NOT a simple one-shot: per the description, arbitrary command execution additionally requires a leading @ argument-file filename AND attacker control of the referenced text file's contents. Mere argument injection (hyphen-leading filename) is easy; weaponized RCE is conditional. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no POC flag was supplied, so there is no evidence of active exploitation; however, the upstream advisory and commit include a regression test demonstrating the argument-injection primitive, indicating the mechanism is well-understood and reproducible. Net: a real, fixable defect warranting prompt patching where Pillow processes attacker-influenced EPS filenames, but not a drop-everything internet-wide worm candidate given the AT:P preconditions and absence of KEV/EPSS signals.

A web application lets users upload images and passes the uploaded file's attacker-controlled name directly to Pillow to open EPS input; Ghostscript is installed on the server. The attacker supplies a filename beginning with '@' that points to a text file they also control (e.g. another uploaded file), whose contents are injected as additional Ghostscript arguments, achieving command execution even under the default -dSAFER invocation. No public weaponized exploit was identified at time of analysis, though the vendor advisory documents a reproducing chain.