Vulnerability record/PUBLISHED/Published Oct 30, 2026 03:09:49 UTC

CVE-2026-114523

Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.

Base score9.8/ 10

SeverityCriticalCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityCritical

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredNonePR

User interactionNoneUI

ScopeUnchangedS

Confidentiality impactHighC

Integrity impactHighI

Availability impactHighA

CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritydrupal

Last updatedNov 6, 2026 15:57:58 UTC

PublishedOct 30, 2026 03:09:49 UTC

ReservedOct 21, 2026 17:08:25 UTC

Credits

Marcus Johansson (marcus_johansson)
Marcin Grabias (graber)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Juraj Nemec (poker10)