OS Command Injection Vulnerability in Ffmpeg Image Toolkit by Drupal
CVE-2026-114523

Currently unrated

Key Information:

Vendor: Drupal
Status: Ffmpeg Image Toolkit
Vendor: CVE Published:; 30 October 2026

What is CVE-2026-114523?

A vulnerability exists in the Ffmpeg Image Toolkit for Drupal due to improper neutralization of special elements used in operating system commands. This flaw can lead to an OS Command Injection, allowing attackers to execute arbitrary commands on the server. The issue is present in versions ranging from 0.0.0 to 1.0.3, making it critical for users to upgrade to secure versions to mitigate potential risks.

Affected Version(s)

Ffmpeg Image Toolkit 0.0.0 < 1.0.3

References

https://www.drupal.org/sa-contrib-2026-220

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 30, 2026
Vulnerability Reserved
Oct 21, 2026

Credit

Marcus Johansson (marcus_johansson)

Marcin Grabias (graber)

Swan Kalata (akalata)

Greg Knaddison (greggles)

Juraj Nemec (poker10)

CVE-2026-114523 Data

JSON