DRUPAL-CONTRIB-2026-220

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/ffmpeg_image_toolkit/DRUPAL-CONTRIB-2026-220.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-220
Aliases
  • CVE-2026-114523
Published
2026-10-21T17:35:01Z
Modified
2026-10-21T18:15:03Z
Summary
[none]
Details

This module enables you to use ffmpeg for image conversion

The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool.

This vulnerability is mitigated by the fact that an attacker must be able to upload images on the site.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/ffmpeg_image_toolkit

Package

Name
drupal/ffmpeg_image_toolkit
Purl
pkg:composer/drupal/ffmpeg_image_toolkit?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.0.3
Database specific
Show details 
{
    "constraint":  "<1.0.3"
}

Database specific

affected_versions 
"<1.0.3"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/ffmpeg_image_toolkit/DRUPAL-CONTRIB-2026-220.json"