{"id":"CVE-2026-114523","kind":"vulnerability","aliases":["CVE-2026-114523"],"related":[],"title":"Drupal FFmpeg Image Toolkit: OS command injection lets attackers run commands","description":"Improper Neutralization of Special Elements used in an OS Command (\"OS Command Injection\") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.","summary":"The Drupal FFmpeg Image Toolkit module fails to neutralize special characters in input passed to an operating system command. An attacker who can supply that input can run arbitrary commands on the server.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check whether the `ffmpeg_image_toolkit` module is installed in the Drupal site, for example with `drush pm:list | grep ffmpeg`\n- Check the installed module version in its `.info.yml` file; versions from 0.0.0 to 1.0.3 are listed as affected","fix":"- Drupal FFmpeg Image Toolkit: versions after `1.0.3` (the sources do not name the fixed version)","status":"open","published_at":"2026-10-30T04:18:10+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:15+00:00","updated_at":"2026-10-30T04:31:15+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:15Z","model":"claude-haiku-5-5","output":{"fix":"- Drupal FFmpeg Image Toolkit: versions after `1.0.3` (the sources do not name the fixed version)","reach":"unknown","title":"Drupal FFmpeg Image Toolkit: OS command injection lets attackers run commands","impact":"high","summary":"The Drupal FFmpeg Image Toolkit module fails to neutralize special characters in input passed to an operating system command. An attacker who can supply that input can run arbitrary commands on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","self-hosted","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Commands run on the server with the web server's privileges","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version, the vulnerable input path, and whether authentication is required.","how_to_check":"- Check whether the `ffmpeg_image_toolkit` module is installed in the Drupal site, for example with `drush pm:list | grep ffmpeg`\n- Check the installed module version in its `.info.yml` file; versions from 0.0.0 to 1.0.3 are listed as affected","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that have the FFmpeg Image Toolkit module installed, in the affected version range, are exposed. The sources do not say whether the vulnerable input is reachable by anonymous visitors or only by logged-in users, and do not describe the default configuration. Sites without this module can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000709,"input_tokens":4125,"output_tokens":593,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114523':14A,17A '-2026':13A,16A '0.0.0':88C '1.0.3':90C 'affect':82C 'allow':76C 'arbitrari':52B 'attack':9A,44B 'charact':34B 'command':6A,11A,42B,53B,66C,68C,78C 'cve':12A,15A 'drupal':1A,18B,25B,72C 'element':61C 'fail':30B 'ffmpeg':2A,26B,73C,83C 'host':23B 'imag':3A,27B,74C,84C 'improp':57C 'inject':7A,69C,79C 'input':36B,49B 'issu':81C 'let':8A 'modul':29B 'neutral':32B,58C 'oper':40B 'os':5A,65C,67C,77C 'packag':19B 'pass':37B 'php':20B 'run':10A,51B 'self':22B 'self-host':21B 'server':56B 'special':33B,60C 'suppli':47B 'system':41B 'toolkit':4A,28B,75C,85C 'use':62C 'version':86C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that have the FFmpeg Image Toolkit module installed, in the affected version range, are exposed. The sources do not say whether the vulnerable input is reachable by anonymous visitors or only by logged-in users, and do not describe the default configuration. Sites without this module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114523","severity":null,"published_at":"2026-10-30T04:18:10+00:00","modified_at":"2026-10-30T04:18:10+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}