Pillow before 13.0.0: one crafted image file can run code on your server, update now
Anyone whose Python app opens uploaded images with Pillow, such as a thumbnailer or an avatar handler.
How to fix it
You haveUpdate to
before 13.0.0→13.0.0
Check your version
Which version you havepip show pillow
Update
pippip install --upgrade "pillow>=13.0.0"
uv add "pillow>=13.0.0"
The bug sits in the FlashPix reader, which Pillow only uses when the optional olefile package is installed. Pillow spots these files by their contents, so renaming an upload doesn't help.