PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-114523 Drupal CVE debrief

The ffmpeg_image_toolkit module for Drupal does not sufficiently sanitize file names passed to the ffmpeg cli tool, potentially allowing attackers to execute arbitrary commands if they can upload images on the site. This vulnerability is particularly concerning for sites that allow image uploads from untrusted users, as it could lead to significant compromise if exploited. Defenders should be aware of the potential impact and take steps to verify and secure image upload and processing workflows.

Vendor
Drupal
Product
ffmpeg_image_toolkit
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-21
Advisory published
2026-10-21
Advisory updated
2026-10-21

Who should care

Defenders managing Drupal installations with the ffmpeg_image_toolkit module, especially those allowing image uploads from untrusted users, should prioritize verifying image upload and processing workflows. This includes assessing exposure, reviewing module versions, and ensuring that appropriate security measures are in place to mitigate the potential for arbitrary command execution.

Why it matters

Defenders should prioritize verifying image upload and processing workflows, especially in contexts where untrusted users can upload images, due to the potential for arbitrary command execution.

  • Potential for arbitrary command execution if exploited
  • Need for verification of image upload and processing workflows
  • Importance of updating module versions to 1.0.3 or later

Technical summary

The ffmpeg_image_toolkit module for Drupal does not sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerability requires an attacker to be able to upload images on the site to be exploited. The module's lack of proper sanitization could lead to arbitrary command execution, making it crucial for defenders to assess their exposure, especially in contexts where untrusted users can upload images.

Defensive priority

Defenders should prioritize verifying image upload and processing workflows, especially in contexts where untrusted users can upload images.

Recommended defensive actions

  • Verify image upload and processing workflows
  • Assess exposure in contexts where untrusted users can upload images
  • Review and update module versions to 1.0.3 or later

Evidence notes

The vulnerability is mitigated by the requirement for an attacker to be able to upload images on the site. The module enables the use of ffmpeg for image conversion.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-114523 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-114523

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-114523 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-114523

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • DRUPAL-CONTRIB-2026-220

    Unverified legacy reference

    URL: https://storage.googleapis.com/osv-vulnerabilities/Packagist/DRUPAL-CONTRIB-2026-220.json

    osv_dev

  • Source reference

    Unverified legacy reference

    URL: https://www.drupal.org/sa-contrib-2026-220

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.