Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Ffmpeg Image Toolkit by Drupal

    CVE-2026-114523 (GCVE-0-2026-114523)

    Vulnerability from nvd – Published: 2026-10-30 03:09 – Updated: 2026-10-30 03:09
    VLAI
    Title
    Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220
    Summary
    Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.
    Severity
    No CVSS data available.
    CWE
    • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection")
    Assigner
    drupal CNA under the mitre root
    CNA scorecard D 53/100 over 279 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Drupal Ffmpeg Image Toolkit Affected: 0.0.0 , < 1.0.3 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-21 17:35
    Credits
    Marcus Johansson (marcus_johansson) Marcin Grabias (graber) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/ffmpeg_image_toolkit",
          "product": "Ffmpeg Image Toolkit",
          "repo": "https://git.drupalcode.org/project/ffmpeg_image_toolkit",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.0.3",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Marcus Johansson (marcus_johansson)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Marcin Grabias (graber)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-10-21T17:35:01.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Special Elements used in an OS Command (\"OS Command Injection\") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\"OS Command Injection\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:09:49.279Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-220"
        }
      ],
      "title": "Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-114523",
    "datePublished": "2026-10-30T03:09:49.279Z",
    "dateReserved": "2026-10-21T17:08:25.387Z",
    "dateUpdated": "2026-10-30T03:09:49.279Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-114523 (GCVE-0-2026-114523)

    Vulnerability from cvelistv5 – Published: 2026-10-30 03:09 – Updated: 2026-10-30 03:09
    VLAI
    Title
    Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220
    Summary
    Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.
    Severity
    No CVSS data available.
    CWE
    • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection")
    Assigner
    drupal CNA under the mitre root
    CNA scorecard D 53/100 over 279 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Drupal Ffmpeg Image Toolkit Affected: 0.0.0 , < 1.0.3 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-21 17:35
    Credits
    Marcus Johansson (marcus_johansson) Marcin Grabias (graber) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/ffmpeg_image_toolkit",
          "product": "Ffmpeg Image Toolkit",
          "repo": "https://git.drupalcode.org/project/ffmpeg_image_toolkit",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.0.3",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Marcus Johansson (marcus_johansson)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Marcin Grabias (graber)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-10-21T17:35:01.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Special Elements used in an OS Command (\"OS Command Injection\") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\"OS Command Injection\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:09:49.279Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-220"
        }
      ],
      "title": "Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-114523",
    "datePublished": "2026-10-30T03:09:49.279Z",
    "dateReserved": "2026-10-21T17:08:25.387Z",
    "dateUpdated": "2026-10-30T03:09:49.279Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}