---
id: "CVE-2026-114523"
kind: "vulnerability"
aliases: ["CVE-2026-114523"]
title: "Drupal FFmpeg Image Toolkit: OS command injection lets attackers run commands"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "php", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:18:10+00:00"
first_seen_at: "2026-10-30T04:28:36+00:00"
updated_at: "2026-10-30T04:31:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114523", "first_seen_at": "2026-10-30T04:28:36+00:00"}]
---

# Drupal FFmpeg Image Toolkit: OS command injection lets attackers run commands

The Drupal FFmpeg Image Toolkit module fails to neutralize special characters in input passed to an operating system command. An attacker who can supply that input can run arbitrary commands on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `ffmpeg_image_toolkit` module is installed in the Drupal site, for example with `drush pm:list | grep ffmpeg`
- Check the installed module version in its `.info.yml` file; versions from 0.0.0 to 1.0.3 are listed as affected

## Fix

- Drupal FFmpeg Image Toolkit: versions after `1.0.3` (the sources do not name the fixed version)

## Timeline

- 2026-10-30T04:28:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114523

## From the sources

Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_