---
id: CVE-2026-114523
title: >-
  Ffmpeg Image Toolkit - Highly critical - Remote Code Execution -
  SA-CONTRIB-2026-220
summary: >-
  Improper Neutralization of Special Elements used in an OS Command ("OS Command
  Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command
  Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to
  1.0.3.
severity: none
cwe:
  - CWE-78
vendor: Drupal
product: Ffmpeg Image Toolkit
affected:
  - ffmpeg_image_toolkit >= 0.0.0 < 1.0.3
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T03:09:49.279Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114523'
references:
  - url: 'https://www.drupal.org/sa-contrib-2026-220'
tags:
  - cve.org
epss: 0.00527
epssPercentile: 0.44731
ingestedAt: '2026-11-03T10:42:03.616Z'
---

## Overview

Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.

## Affected

- `ffmpeg_image_toolkit >= 0.0.0 < 1.0.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.