View online: https://www.drupal.org/sa-contrib-2026-220 Project: Ffmpeg Image Toolkit [1] Project machine name: ffmpeg_image_toolkit Date: 2026-October-21 Security risk: *Highly critical* 20 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Remote Code Execution Affected versions: <1.0.3 CVE IDs: CVE-2026-114523 Description:  This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerability is mitigated by the fact that an attacker must be able to upload images on the site. Solution:  Install the latest version: * If you use the Ffmpeg Image Toolkit 1.x, upgrade to Ffmpeg Image Toolkit 1.0.3 [3] Reported By:  * Marcus Johansson (marcus_johansson) [4] Fixed By:  * Marcin Grabias (graber) [5] Coordinated By:  * Swan Kalata (akalata) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/ffmpeg_image_toolkit [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ffmpeg_image_toolkit/releases/1.0.3 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/graber [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....