CVE-2026-114523

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114523
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114523.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-114523
Aliases
Published
2026-10-30T03:09:49Z
Modified
2026-11-08T02:30:34Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220
Details

Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.

Database specific 
{
    "cna_assigner": "drupal",
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114523.json"
}
References

Affected packages

Git / git.drupalcode.org/project/ffmpeg_image_toolkit

Affected ranges

Type
GIT
Repo
https://git.drupalcode.org/project/ffmpeg_image_toolkit
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d4f1c227dd8d36cbaf929d93b15f5989ba2d78f3
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0.0.0"
                },
                {
                    "fixed": "1.0.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

1.*
1.0.0
1.0.0-beta1
1.0.0-beta2
1.0.0-beta3
1.0.1
1.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114523.json"