DRUPAL-CONTRIB-2026-220: Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220
Published Oct 30, 2026
·Updated
Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.
Affected Software
1 affected component
Drupal Ffmpeg Image Toolkit>=0.0.0<=1.0.3
Event History
Oct 30, 2026
CVE Published
via OSV·03:09 AM
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which versions are affected?
Drupal Ffmpeg Image Toolkit versions from 0.0.0 through 1.0.3 are affected.
2
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction.
3
What is the potential impact of successful exploitation?
Successful OS command injection can result in high impact to confidentiality, integrity, and availability.