Medium4.5Red Hat Linux Updated
Arbitrary command injection via shell metacharacters in file paths
CVE-2026-55798 Published Jul 6, 2026Updated by vendor Jul 6, 2026
Affected products & platforms
Red Hat LinuxUnclassified
Summary
Arbitrary command injection via shell metacharacters in file paths. Red Hat rates this moderate (CVSS 4.5). Weakness: CWE-78.
Affected versions
- < 12.3.0
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
Mitigation checklist
Recommended fix / mitigation
- This vulnerability is specific to the WindowsViewer class in Pillow, which is only invoked on Windows systems. Red Hat products ship and run on Linux, where the UnixViewer class is used instead, which properly applies shlex.quote() to file paths. The vulnerable Windows code path is not reachable on Red Hat's supported platforms. Users can upgrade to Pillow 12.3.0 or later, which adds proper escaping to the Windows code path.
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.