Python uchun eng keng tarqalgan rasm kutubxonasi Pillow, serverda operatsion tizim buyruqlarini bajarish uchun ochilishi aytilgan fayl nomini ko'rsatish orqali ishlatilishi mumkin.
CVE-2026-112900 deb nomlangan zaiflik Pillow'ning EPS rasmlarini qayta ishlash usulida yotadi: u fayl nomini avval tekshirmasdan, rasmni piksellarga aylantirish uchun alohida dastur — Ghostscript'ga yuboradi.
Ghostscript hujumchi tanlagan nomni fayl emas, balki ko'rsatma sifatida o'qishi mumkin va uni bajariladigan buyruqlarni o'z ichiga olgan ikkinchi faylga yo'naltirishi mumkin. Pillow'ning ishlab chiquvchilari buni 16-oktabrda chiqarilgan 13.0.0 versiyasida tuzatishdi.
Pillow Python rasmlarni qayta ishlaydigan deyarli har joyda uchraydi: veb yuklash shakllari, avatar va eskiz vositalari, hujjat va PDF quvurlari, shuningdek, ko'pchilik mashina o'rganish loyihalari uni o'z ichiga oladi. Zaifliklarga e'tiborni qaratgan OX Security firmasi kutubxona oyiga taxminan 436 million marta yuklanishini hisoblaydi.
13.0.0 versiyasi katta xavfsizlik yangilanishi bo'lib, to'rtta jiddiylik darajasidagi — pastdan tanqidiygacha — tuzatishlarni o'z ichiga oladi, ulardan ikkitasi ishlab chiquvchilar tomonidan tanqidiy deb baholangan. Hech bir zaiflik hozircha hujum ostida ekani ma'lum emas.
Zaiflik rasmda emas, fayl nomida. "Zaiflik fayl nomi orqali ishga tushadi, PostScript hujjatidagi hech narsa orqali emas," deb aytiladi maslahatda, ya'ni zararsiz EPS fayl ham hujumchi uning nomini o'rnatganida zarar yetkazishi mumkin. Bu yuklash nuqtalarini, foydalanuvchi kiritgan ma'lumotdan saqlangan fayl nomini saqlaydigan yoki quradigan, haqiqiy nishonga aylantiradi.
Zaiflik faqat Ghostscript o'rnatilgan, ya'ni gs dasturi mavjud bo'lgan xostlarda ishlaydi, chunki Pillow EPS ochish uchun unga muhtoj. U Pillow'ning 2.6.0 dan 12.3.0 gacha bo'lgan versiyalariga ta'sir qiladi.
Ishlab chiquvchilar buni o'rtacha deb baholashadi, chunki hujumchi fayl nomini nazorat qilishi kerak. GitHub tomonidan berilgan CVE yozuvi uni 10 dan 9.2 deb baholaydi va xuddi shu shartni belgilaydi.
Ikkita tuzatish ishlab chiquvchilarning eng yuqori "tanqidiy" darajasida. Biri alohida xotira xatosi bo'lib, reliz eslatmalarida rejim o'zgargandan keyin eski rasm ma'lumotlari qayta ishlatilishi deb ta'riflangan. Ikkinchisi Pillow'ning JPEG dekodlashidagi ikkita to'lib ketish zaifligini qamrab oladi.
Ushbu JPEG zaifliklaridan biri, FlashPix (FPX) formatida, Image.open() yagona chaqiruvi bilan tayyorlangan faylda hujumni bajarishi ko'rsatildi, agar ixtiyoriy olefile paketi o'rnatilgan bo'lsa. Pillow bu fayllarni kengaytmasi emas, balki mazmuni orqali taniydi, shuning uchun ishonchsiz yuklamalarni ochadigan server hech qanday foydalanuvchi harakatisiz zararlanishi mumkin.
Ikkinchisi, CVE-2026-112403, dastur tayyorlangan yo'qotishsiz JPEG'dan eskiz (thumbnail) yaratganda xotira buferini to'ldirib yuboradi. Uning maslahati jarayonning ishdan chiqishini, kod bajarilishini emas, xabar qiladi. Bu xato "Anthropic tomonidan Claude yordamida ochiq manba dasturiy ta'minot xavfsizligini o'rganish orqali topilgan, Ada Logics tomonidan qo'lda tasdiqlangan," deb aytiladi maslahatda — bu kompaniyaning kengroq sa'y-harakatining bir qismi bo'lib, u ochiq manba kutubxonalarida yuzlab zaifliklarni aniqlagan.
Uchinchi zaiflik, CVE-2026-112393, Pillow'da 2013-yildan beri mavjud. U dastur siqilgan TIFF rasmini diskdagi faylga emas, balki xotiraga saqlaganda xotira buferini to'ldirib yuboradi — bu yuklamani qayta kodlab, foydalanuvchiga qaytaradigan xizmat uchun odatiy naqsh. Maslahatda aytilishicha, tadqiqotchilar bu bilan jarayonni ishdan chiqargan va faqat xotira manzillarini ochib beradigan ikkinchi, alohida zaiflik yordamida kod bajarishga aylantirgan. Diskdagi haqiqiy faylga saqlash ta'sirlanmaydi.
GitHub tomonidan berilgan CVE yozuvlari EPS, TIFF va JPEG-eskiz zaifliklarini 10 dan 9.2 deb baholaydi — bu tanqidiy reyting. Har biri ballar o'z ichiga olmaydigan shartlarga bog'liq, va ishlab chiquvchilarning o'z baholari o'rtachadan tanqidiygacha o'zgaradi. CVE yozuvlarida CISA tahlilchilari EPS zaifligi uchun ma'lum ekspluatatsiya yo'qligini, TIFF zaifligi uchun esa ommaviy isbot-konseptsiyani belgilaydi.
Nima qilish kerak
Barcha zaifliklarni tuzatuvchi Pillow 13.0.0 ga yangilang va eski nusxani o'z ichiga olgan har qanday konteyner, g'ildirak yoki asosiy rasmlarni qayta quring. Pillow 13 Python 3.10 ni tashlab ketadi, shuning uchun hali 3.10 da bo'lgan o'rnatishlar Python 3.11 yoki yangiroq versiyaga ham muhtoj.
pip install -U "Pillow>=13.0.0" Yangilashgacha, Pillow'ning xavfsizlik yo'riqnomasi va maslahatlari har bir yo'lni kesadigan qadamlarni ko'rsatadi:
- EPS / Ghostscript: ishonchsiz yuklamalarni qayta ishlaydigan har qanday xostda
gsdasturini o'chirib qo'ying va EPS uchunImage.open()ga hujumchi nazorat qiladigan fayl nomini hech qachon uzatmang. - JPEG eskizlari: ishonchsiz JPEG'larda
draft()vathumbnail()dan qoching, yoki avvalload()ni chaqiring, yokireducing_gap=Noneni uzating. - TIFF: rasm foydalanuvchidan kelganida
io.BytesIOkabi xotiradagi buferga TIFF saqlashni sezgir yo'l sifatida ko'ring.
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open.
The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.
Ghostscript can read a name chosen by an attacker as instructions rather than as a file, and point it to a second file that carries commands to run. Pillow's maintainers fixed it in version 13.0.0, released on October 16.
Pillow turns up almost everywhere Python handles images: web upload forms, avatar and thumbnail tools, document and PDF pipelines, and most machine-learning projects pull it in. OX Security, the firm whose report drew attention to the flaws, estimates the library is downloaded about 436 million times a month.
Version 13.0.0 is a large security release, with fixes across four severity levels, from low to critical, two of which are rated critical by the maintainers. None of the flaws is known to be under attack.
The weakness is the filename, not the picture. "The flaw is triggered by the filename, not by anything in the PostScript document," the advisory says, meaning a harmless EPS file can still cause damage when an attacker sets its name. That makes upload endpoints that keep or build a stored file's name from user input the realistic target.
The flaw only reaches Ghostscript on hosts that have the gs program installed, which Pillow needs to open EPS at all. It affects Pillow from version 2.6.0 up to 12.3.0.
The maintainers rate it moderate, because the attacker has to control the filename. The CVE record assigned by GitHub rates it 9.2 out of 10 and marks it as the same condition.
Two of the fixes sit in the maintainers' top "critical" tier. One is a separate memory bug, described in the release notes as stale image data reused after a mode change. The other covers two overflow flaws in Pillow's JPEG decoding.
One of those JPEG flaws, in the FlashPix (FPX) format, was shown to run an attacker's command from a single call to Image.open() on a crafted file, as long as the optional olefile package is installed. Pillow recognizes these files by their content, not their extension, so a server that opens untrusted uploads can be hit with no user action.
The other, CVE-2026-112403, overflows a memory buffer when a program makes a thumbnail of a crafted lossless JPEG. Its advisory reports a crash, not code execution. The bug was "found by Anthropic using Claude to study the security of open-source software, validated manually by Ada Logics," the advisory says, part of a wider effort by the company that has turned up hundreds of flaws in open-source libraries.
A third flaw, CVE-2026-112393, has been in Pillow since 2013. It overflows a memory buffer when a program saves a compressed TIFF image to memory rather than to a file on disk, the common pattern for a service that re-encodes an upload and hands it back. The advisory says the reporters crashed the process with it, and turned it into code execution only with the help of a second, separate flaw that leaked memory addresses. Saving to a real file on disk is not affected.
The CVE records, assigned by GitHub, score the EPS, TIFF, and JPEG-thumbnail flaws 9.2 out of 10, a critical rating. Each depends on conditions the score does not carry, and the maintainers' own ratings for the batch run from moderate to critical. In the CVE records, CISA's analysts mark no known exploitation for the EPS flaw and a public proof of concept for the TIFF one.
What to do
Upgrade to Pillow 13.0.0, which fixes all of these, and rebuild any containers, wheels, or base images that bundle an older copy. Pillow 13 drops Python 3.10, so installs still on 3.10 need Python 3.11 or newer as well.
pip install -U "Pillow>=13.0.0" Until you can upgrade, Pillow's security guidance and the advisories point to steps that cut each path:
- EPS / Ghostscript: keep the
gsprogram off any host that processes untrusted uploads, and never pass an attacker-controlled filename toImage.open()for EPS. - JPEG thumbnails: avoid
draft()andthumbnail()on untrusted JPEGs, or callload()first, or passreducing_gap=None. - TIFF: treat saving a TIFF to an in-memory buffer such as
io.BytesIOas a sensitive path when the image came from a user.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.