Live › vulnerability › CVE-2026-114523
The Drupal FFmpeg Image Toolkit module fails to neutralize special characters in input passed to an operating system command. An attacker who can supply that input can run arbitrary commands on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that have the FFmpeg Image Toolkit module installed, in the affected version range, are exposed. The sources do not say whether the vulnerable input is reachable by anonymous visitors or only by logged-in users, and do not describe the default configuration. Sites without this module can skip it.
No product ranges from the sources yet.
ffmpeg_image_toolkit module is installed in the Drupal site, for example with drush pm:list | grep ffmpeg.info.yml file; versions from 0.0.0 to 1.0.3 are listed as affected1.0.3 (the sources do not name the fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-114523")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.