Security AlertHigh
Pillow image library flaw can run server commands
Oct 23, 2026 · Summarized by Fundy Tech from The Hacker News
The 30-second version
Pillow has a flaw that can let an attacker run operating system commands on a server through a crafted file name. The maintainers fixed it in version 13.0.0.
Key points
- The flaw is CVE-2026-112900.
- It affects Pillow from 2.6.0 up to 12.3.0.
- The maintainers say no flaws in the batch are known to be under attack.
Why it matters
Many Python apps use Pillow for image handling. If your business accepts image uploads, this could matter where file names are controlled by users.
Who’s affected: Python apps using Pillow and Ghostscript
What to do
- Update Pillow to version 13.0.0.
- Review image upload handling.
- Avoid trusting user-controlled file names.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.