The vulnerability is an OS Command Injection flaw in the Drupal Ffmpeg Image Toolkit. An attacker who can supply input to the toolkit can cause arbitrary shell commands to be executed on the host, giving the attacker the same privileges as the Drupal service. The weakness is an improper neutralization of special elements used in OS commands, in line with CWE-78.

Drupal sites that use the Ffmpeg Image Toolkit module are affected. Versions ranging from 0.0.0 up to and including 1.0.3 contain the vulnerability and must be replaced or patched.

The attack vector is likely remote through the image upload interface, though specific authentication requirements are not included in the data. Because no EPSS score is available, the exploitation likelihood cannot be quantified from the provided information, but OS command injection is a high‑impact flaw. The vulnerability is not listed in the CISA KEV catalog and no official vendor recommendation or patch is presently provided in the data.