CVE-2026-112900

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-112900 Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-112900

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-112900 Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-112900

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-112900

The Pillow Python imaging library (versions 2.6.0 through 13.0.0) is vulnerable to argument injection during the processing of EPS input via Ghostscript . The EpsImagePlugin.Ghostscript component fails to convert caller-controlled input filenames to safe absolute paths when passed to the -f flag;...

CVE-2023-36664

CVE-2023-36664 : Ghostscript remote code execution Proof of concept for the CVE-2023-36664. Usage To insert a payload into a .eps file : python3 poc.py -f "filename" --payload "command" python3 poc.py -f file.eps --payload firefox To insert a reverse shell payload into a .eps file : python3 poc.p...

CVE-2017-8291

Python PIL/Pillow Remote Command Execution GhostButt / CVE-2017-8291 中文版本Chinese version Python PIL Pillow is a popular image processing library for Python. It supports various image formats and provides powerful image manipulation capabilities. The Python image processing module PIL Pillow is...

CVE-2023-36664-Ghostscript-command-injection

Ghostscript command injection vulnerability PoC CVE-2023-36664 Vulnerability disclosed in Ghostscript prior to version 10.01.2 leads to code execution CVSS score 9.8. Official vulnerability description: Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices with the...

CVE-2018-16509

CVE-2018-16509 Ghostscript contains multiple -dSAFER sandbox bypass vulnerabilities Run $ docker run -d --name cve-2018-16509 -p 9000:9000 cve-2018-16509...

ghostscript-CVE-2023-43115

ghostscript-CVE-2023-43115 A small write-up with examples to help understand CVE-2023-43115. !WARNING I wrote this mainly for myself to understand the problem and to learn about cybersecurity. So there may be errors. The Problem To utilize the IJS device Improved Inkjet Printing, Ghostscript is...

MiracleLinux 9 : ghostscript-9.54.0-19.el9_8.3 (AXSA:2026-2092:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2092:04 advisory. ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use- after-free CVE-2026-101258 ghostscript:...

PT-2026-117686

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2022-35649

CVE-2022-35649 Payload Generator using Python 2 and Detailed Analysis for CVE-2022-35649 The PoC in python generates payload when exploited for a 0-day of GhostScript 9.50. This 0-day exploit affect to ImageMagick with the default settings from Ubuntu repository Tested with default settings of...

CVE-2015-0235-test

CVE-2015-0235-test Ansible playbook to check vulnerability for CVE-2015-0235. This is based on the test program provided by the University of Chigago link. Ansible will allow you to specify a large number of host machines to test at once. This does not patch or restart anything , it only reports ...

PIL-RCE-Ghostscript-CVE-2018-16509

Python PIL/Pillow Remote Shell Command Execution via Ghostscript CVE-2018-16509 Inspired by https://github.com/ysrc/PIL-RCE-By-GhostButt PIL/Pillow RCE via CVE-2017-8291. This docker environment version is using the newer version of Ghostscript v9.23 and newer exploit CVE-2018-16509. Ghostscript ...

CVE-2019-14811-in-pdf-exploit

CVE-2019-14811 GhostScript PDF preview Exploit PoC This exploit targets CVE-2019-14811 in GS environments where PostScript output is not reflected, but is executed such as PDF previews via png images. Exploit renders commands directly in pngXXm preview, it is based on...

cve-2023-34446

CVE-2023-36664: Ghostscript Remote Code Execution Vulnerability Summary CVE ID: CVE-2023-36664 Product: Ghostscript 10.01.2 Vulnerability Type: Remote Code Execution RCE Overview This vulnerability CVE-2023-36664 is an arbitrary code execution RCE vulnerability caused by Ghostscript's inadequate...

Rocky Linux 10.2 [CIQ] Security Update: ghostscript / ghostscript-debuginfo / ghostscript-debugsource / etc Multiple Vulnerabilities (crlsa-2026_83551)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202683551 advisory. ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use- after-free CVE-2026-101258 ghostscript:...

Rocky Linux 8 [CIQ] Security Update: ghostscript / ghostscript-debuginfo / ghostscript-debugsource / etc Multiple Vulnerabilities (crlsa-2026_83552)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202683552 advisory. ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use- after-free CVE-2026-101258 ghostscript: ghostscrip...