SA-CONTRIB-2026-220: Critical severity drupal/ffmpeg_image_toolkit vulnerability

Q: Who is exposed to this issue?

Sites using the Drupal ffmpeg_image_toolkit module are exposed if users who may be malicious can upload images that will be processed through the module's ffmpeg-based image conversion.

Q: What does an attacker need to exploit it?

An attacker must be able to upload images to the site. Exploitation involves filenames that are passed to the ffmpeg command-line tool without sufficient sanitization.

Published Oct 21, 2026

Updated

This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerability is mitigated by the fact that an attacker must be able to upload images on the site.

Credit

Marcus Johansson (marcus_johansson)

Affected Software

1 affected componentFixes available

drupal/ffmpeg_image_toolkit<1.0.3

1.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/ffmpeg_image_toolkit to a version that resolves this vulnerability.
Fixed in 1.0.3

Event History

Oct 21, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114523

Frequently Asked Questions

Who is exposed to this issue?

Sites using the Drupal ffmpeg_image_toolkit module are exposed if users who may be malicious can upload images that will be processed through the module's ffmpeg-based image conversion.

What does an attacker need to exploit it?

An attacker must be able to upload images to the site. Exploitation involves filenames that are passed to the ffmpeg command-line tool without sufficient sanitization.

SA-CONTRIB-2026-220: Critical severity drupal/ffmpeg_image_toolkit vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?