Skip to content

CVE-2026-114523 Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220

CriticalCVSS 9.8 EPSS 1.0%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.

Affected products

ProductAffected versionsFixed in
drupal/ffmpeg_image_toolkit(Packagist:https://packages.drupal.org/8) < 1.0.3 1.0.3
drupal/ffmpeg_image_toolkit >= 0.0.0, < 1.0.3 1.0.3

References