CVE-2026-112900: Pillow EPS Filename Argument Injection to RCE

CVE-2026-112900 is an argument-injection flaw in Pillow's EPS/Ghostscript image handler: because Pillow passes an attacker-influenced filename straight into the Ghostscript command line at the -f position without normalizing it, a filename starting with '-' or '@' lets an attacker inject Ghostscript options, and NVD's own analysis scores it 9.8 critical because this has been verified to escalate to remote code execution.

CVE-2026-112900 affects PIL.EpsImagePlugin.Ghostscript(), the function Pillow uses to rasterize EPS/PostScript images via the external gs (Ghostscript) binary. When Pillow opens a file-like object that exposes a .name attribute pointing to an on-disk path, it uses that path as-is as the -f <infile> argument to Ghostscript. Ghostscript treats a leading -/-- in that position as a command-line option rather than a filename, and a leading @ as its own argument-file syntax that tells it to read further arguments from the named file — so an attacker who controls the filename reaching Image.open() (for example, a file-upload endpoint that preserves or derives the stored filename from user input) can inject Ghostscript arguments. Pillow's default -dSAFER sandboxing flag does not block this, because the injection happens before any PostScript content is interpreted (GitHub Security Advisory GHSA-w889-685w-c8fh).

The reporting researcher published two proof-of-concepts: a minimal one using a file named -h that gets parsed as a Ghostscript help flag, and a full chain using a filename of @arg where arg is an attacker-supplied text file containing Ghostscript PostScript directives that redirect -sOutputFile to a named pipe and execute /bin/id, demonstrating command execution with Ghostscript 10.02.1 and again with the current 10.07.1 release (GHSA-w889-685w-c8fh).

NVD performed its own CNA analysis and assigned a Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, categorized under CWE-78 (OS Command Injection); GitHub's own CNA submission rates it CVSS v4.0 9.2 (Secondary) (NVD). The flaw is tracked as CWE-88 (Argument Injection) escalating to CWE-78 by the reporting researcher.

The issue affects Pillow 2.6.0 through 12.3.0 — effectively every maintained release prior to the fix — and is resolved in Pillow 13.0.0, released 2026-10-17, which normalizes the filename with os.path.abspath() before handing it to Ghostscript so a leading - or @ can no longer reach the argument parser (GHSA-w889-685w-c8fh).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.0130 (70.5th percentile) (FIRST EPSS). It is not listed in the CISA Known Exploited Vulnerabilities catalog (checked against catalog version 2026.10.30). Because Pillow is one of the most widely depended-on Python imaging libraries, any application that opens EPS/PostScript content using a caller-influenced filename — including services that process user-uploaded images with Ghostscript installed — should upgrade to 13.0.0 without waiting for a reported exploitation event.

• PIL.EpsImagePlugin.Ghostscript() places the unsanitized input filename at Ghostscript's -f position; a filename starting with '-' or '@' is parsed as an option or argument-file token, enabling argument injection chainable to RCE, as demonstrated in a verified proof-of-concept. — GitHub Security Advisory
• NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-78; GitHub's CNA submission scores it CVSS v4.0 9.2 (Secondary). — NVD
• Affects Pillow 2.6.0 through 12.3.0; fixed in Pillow 13.0.0 (released 2026-10-17) by normalizing the filename with os.path.abspath() before passing it to Ghostscript. — GitHub Security Advisory
• EPSS score is 0.0130 (70.5th percentile) as of 2026-10-30; not listed in CISA KEV as of catalog version 2026.10.30. — FIRST EPSS