PatchClock

PHP security digest · 21 Oct 2026

This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerabili...

Unrated CVE-2026-114523

Package
drupal/ffmpeg_image_toolkit
Fixed in
1.0.3
Published
Wed 21 Oct 2026, 18:35 LisbonUpdated Mon 26 Oct 2026, 07:25 Lisbon

In plain words

The module does not sufficiently sanitise file names passed to the ffmpeg command-line tool during image conversion. An attacker must be able to upload images on the site to take advantage of this flaw. The advisory does not specify the resulting impact.

Am I affected?

Look for drupal/ffmpeg_image_toolkit and its version in composer.lock. The advisory lists 1.0.3 as fixed but gives no affected version range. Check whether attackers can upload images on the site, as this is required to exploit the flaw.

What to do

Check which version you have, then update to a fixed release for your branch (1.0.3):

composer show drupal/ffmpeg_image_toolkit | grep versions
composer update drupal/ffmpeg_image_toolkit

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The vulnerability is mitigated by the requirement that an attacker must be able to upload images on the site.

The advisory's description

This module enables you to use ffmpeg for image conversion

The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool.

This vulnerability is mitigated by the fact that an attacker must be able to upload images on the site.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.