Pillow (versions 2.6.0 through 12.3.0)
Pillow is the most widely used Python library for processing images — it handles uploads, thumbnail generation, PDF pipelines, and image conversion across millions of web applications and machine-learning projects, downloaded roughly 436 million times per month.
Root Cause
Pillow passes the filename directly to Ghostscript without sanitising or validating it. The weakness is not in the image content but in the filename itself. Think of it like a librarian who fetches a book by reading the title aloud — if the title is itself an instruction, the system obeys it instead of looking up a book.
Attack Vector
An attacker submits a file with a maliciously crafted filename to an upload endpoint. Pillow passes that filename to Ghostscript during processing. Ghostscript interprets the crafted name as a command and executes it, giving the attacker remote code execution (RCE — the ability to run arbitrary commands on the server) without needing to exploit anything inside the image file itself.
Detection Notes
Look for unexpected shell processes spawned from your Python web application process. Review server logs for unusual child processes originating from image processing jobs. Monitor for unexpected outbound network connections following image upload events.
Recommended Actions
- Upgrade Pillow to version 13.0.0 immediately — this is the patched release.
- If you cannot upgrade now, disable EPS file handling or block EPS uploads at the application layer.
- Audit upload endpoints to ensure filenames from user input are never passed unsanitised to external programs.