Ffmpeg image toolkit: This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. (CVE-2026-114523)

The ffmpeg_image_toolkit Drupal module enables image conversion via ffmpeg but suffers from insufficient sanitization of file names passed to the ffmpeg CLI tool. This flaw could allow an attacker with image upload privileges to potentially manipulate the ffmpeg command execution environment. The vulnerability affects versions before 1.0.3, and a fix has been released to address this issue.

An attacker who can upload images to a site using the vulnerable module could exploit the insufficient file name sanitization to influence the ffmpeg command execution. The impact depends on the attacker's ability to upload files, limiting the exposure to authenticated or otherwise authorized users. No known exploits are reported in the wild.

A patch is available for versions prior to 1.0.3 of the ffmpeg_image_toolkit module. Users should upgrade to version 1.0.3 or later to remediate this vulnerability. Since the vulnerability requires image upload capability, restricting or monitoring upload permissions can also reduce risk.