Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CVE-2026-114523: Drupal FFmpeg Image Toolkit lets attackers run code
CVE-2026-114523 · published 6 days ago
Summary
The FFmpeg Image Toolkit used in Drupal sites (versions up to 1.0.3) can be tricked into executing commands on the server. An attacker could gain control of the system hosting the website. Upgrade to a patched version or remove the module until an update is applied.
What to do
- Update drupal drupal/ffmpeg_image_toolkit to version 1.0.3.
- Update drupal ffmpeg image toolkit to version 1.0.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Packagist:https://packages.drupal.org/8 | drupal | drupal/ffmpeg_image_toolkit |
< 1.0.3 Fix: upgrade to 1.0.3
|
| – | drupal | ffmpeg image toolkit | < 1.0.3 |
Original advisory text
Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220
Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.
References
- https://www.drupal.org/sa-contrib-2026-220 URL
- https://git.drupalcode.org/project/ffmpeg_image_toolkit URL
- https://www.drupal.org/project/ffmpeg_image_toolkit URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-1145... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-114523 Vendor Advisory
Type
CWE-78OS Command Injection
Timeline
Published30 Oct 2026
Updated4 Nov 2026
First seen21 Oct 2026
Sources
DRUPAL-CONTRIB-2026-220 · OSV
CVE-2026-114523 · NVD
CVE-2026-114523 · MITRE
CVE-2026-114523 · OSV
Track software like this
Free during beta