CVE-2026-114523: Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220
Published Oct 30, 2026
·Updated
Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.
Affected Software
1 affected component
Drupal Ffmpeg Image Toolkit>=0.0.0<=1.0.3
Event History
Oct 30, 2026
CVE Published
via MITRE·03:09 AM
Data Sourced
via MITRE·03:09 AM
DescriptionWeakness
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 AM
DescriptionWeakness
Nov 6, 2026
Data Sourced
via NVD·04:17 PM
Severity
Frequently Asked Questions
1
Which versions should be treated as affected?
Ffmpeg Image Toolkit versions from 0.0.0 through 1.0.3 are affected.
2
What should incident responders investigate?
Investigate for potential OS command injection leading to command execution in deployments using an affected Ffmpeg Image Toolkit version.