Filename Tricks in Pillow Can Turn a Safe Image Path into Ghostscript Command Risk

An image upload is usually treated as boring input. This flaw shows why that assumption can be dangerous. In Pillow’s EPS handling path, a filename is handed to Ghostscript as part of the render process, and that string can cross from “data” into “instructions” if it is not validated first. The result is not automatic compromise, but a sharp reminder that filenames themselves can become an attack surface.

Fast Facts

• CVE-2026-112900 affects Pillow’s EPS processing path and is tied to Ghostscript argument injection, reportedly not to direct image-content parsing alone.
• The risky behavior occurs when Pillow passes a filename to Ghostscript without checking whether that name can be parsed as command-line syntax.
• The reported outcome is conditional: argument injection can escalate toward operating-system command execution only if attacker-control prerequisites are met.
• Pillow 13.0.0 is identified as the patched release in the technical advisory context.
• The supplied material does not establish exploitation in the wild, a confirmed breach, or data loss.

What the flaw really changes

The important detail is the trust boundary. Pillow does not execute shell commands by itself here; it invokes Ghostscript, an external renderer, and passes along the EPS filename as an argument. If an attacker can influence that filename, a specially crafted prefix may be interpreted by Ghostscript as an option or an argument-file reference rather than as a literal path. That is classic argument injection, but the dangerous part is subtler than a simple “run code” headline suggests.

Command execution is a downstream possibility, not a guaranteed result. In the strongest case, a crafted filename may steer Ghostscript into reading attacker-chosen arguments, and only then can the chain move toward process-level command execution depending on the environment, file handling, and the exact invocation path. From a defensive perspective, that makes the bug especially relevant to services that process user-supplied EPS files or allow user-influenced filenames to reach backend rendering.

At the time of writing, the available information supports a risk analysis, not a claim that any specific organization was breached or that all Pillow deployments are exposed in practice. Reachability matters: the application must use the EPS path, and the attacker must be able to shape the filename that Pillow forwards to Ghostscript.

Why defenders should care

The lesson goes beyond one library. Any workflow that shells out to a helper tool can inherit that tool’s parser behavior, even if the application never touches a shell directly. That is why safe subprocess construction, filename normalization, and strict input boundaries matter in image pipelines, document converters, and other media services.

For defenders, the immediate steps are practical: inventory Pillow versions, test whether EPS processing is actually needed, restrict untrusted uploads, and upgrade to the patched release. Least privilege and process isolation can reduce impact, but they are not a substitute for patching. The broader lesson is simple: in modern software, a filename is not always harmless text. Sometimes it is the first link in a chain that reaches straight into a command parser.

WIKICROOK

• Argument Injection: A flaw where user-controlled text is parsed as command-line syntax by a downstream program.
• Ghostscript: A rendering engine for PostScript and related formats that other programs can call as a subprocess.
• EPS: Encapsulated PostScript, a graphics format that can be handed to external renderers for conversion.
• Subprocess Boundary: The handoff point where one program invokes another and must pass arguments safely.
• CVE: A standard identifier used to track publicly known cybersecurity vulnerabilities.