34 Drupal Contrib Advisories on October 21: Ffmpeg Image Toolkit First, Then the Common Modules

The Drupal Security Team published 34 Drupal contrib advisories for contributed projects on October 21, 2026, numbered SA-CONTRIB-2026-220 through SA-CONTRIB-2026-253, according to drupal.org’s contributed project advisories page. The most serious is a Highly critical remote code execution flaw in Ffmpeg Image Toolkit, CVE-2026-114523, fixed in version 1.0.3.

Seven more are Critical. Twenty-five are Moderately critical and one is Less critical. The batch covers 31 projects; UI Icons, Swiper formatter and Frontend Editing each have two advisories. Facts here are as of October 23, 2026, from the drupal.org advisory and project pages.

The short version: update Ffmpeg Image Toolkit today if you run it. Next come the Critical issues. Then check the widely used modules in this batch, which are all Moderately critical: Bootstrap, Rabbit Hole, Shield, Simple OAuth, UI Icons and Domain. Every advisory rates exploitation as E:Theoretical, which drupal.org’s risk levels page defines as no public exploit code or documentation on development.

Our October 7 advisory breakdown covered the last large batch of 26 Drupal contrib advisories. This one is bigger.

Ffmpeg Image Toolkit: the one Highly critical advisory

SA-CONTRIB-2026-220 scores 20 out of 25. Ffmpeg Image Toolkit lets Drupal convert images with ffmpeg. Drupal’s advisory says the module does not sufficiently sanitize file names passed to the ffmpeg command-line tool, and rates the flaw as remote code execution. In plain terms, an attacker could run their own commands on your server.

The advisory says the attacker must be able to upload images, which lowers the risk. Its risk string still lists A:None, which the risk levels page defines as all or anonymous users. If anonymous visitors can upload images anywhere on your site, such as a public form, we would treat this as reachable without an account.

All versions before 1.0.3 are affected. The project page lists 1.0.3 as working with Drupal 9, 10 and 11. It also reports one site using the module, so few teams will need this fix. Our post on the Ghostscript PDF upload flaw covers the same pattern: an upload handed to a command-line tool on the server.

The seven Critical Drupal contrib advisories

The Critical band is 15 to 19 on drupal.org’s risk levels page. Here are all eight advisories at Critical or above.

A few details from the advisories change the order. The Custom Formatters advisory says its PHP formatter runs user-provided PHP through eval(), and the permissions screen gives no warning. Its risk string requires admin access. The Monster Menus advisory applies only with the RSS Page submodule on and a role with the "RSS Feed: Create new content" permission. The Dopup advisory needs no login. It says the module may expose the titles of private Webforms in some cases.

The three themes, ABC, Black Hole and Zero Point, share one bug, according to their advisories. Menu link titles are not sanitized before they go into HTML class attributes. An attacker needs to be able to create or edit menu link titles. The UI Icons advisory says the module does not sufficiently validate icon settings before rendering them.

The full list: Moderately and Less critical Drupal contrib advisories

These 26 advisories include several modules that are common on association and university sites, including Simple OAuth, Domain, Bootstrap, Rabbit Hole and Media Bulk Upload.

Six widely used modules in this batch

Usage counts on drupal.org project pages, as of October 23, show which Drupal contrib advisories reach the most sites. Ffmpeg Image Toolkit reports one site and Monster Menus 14. These six report far more.

Bootstrap, 91,201 sites. SA-CONTRIB-2026-236 covers the optional tooltip and popover features in the 8.x-3.x branch. The advisory says the 5.0.x branch is not affected. If you cannot update today, it says to turn off tooltips and popovers in the theme settings.

Rabbit Hole, 74,799 sites. SA-CONTRIB-2026-252 says a query parameter can skip Rabbit Hole’s behavior. Anonymous visitors could see content set to return access denied or not found. A second issue lets anyone who can edit an entity change its Rabbit Hole settings through JSON:API, REST or Views Bulk Operations.

Shield, 27,674 sites. SA-CONTRIB-2026-248 says Shield does not sufficiently limit repeated HTTP basic login attempts. It adds that this only matters if your Shield credentials can be guessed. Until you update, a long random password lowers the risk. Shield’s release notes call 8.x-1.9 the security release; 8.x-1.10 followed the same day.

Simple OAuth, 27,587 sites. SA-CONTRIB-2026-242 affects only 6.1.0 through 6.1.2. The advisory says cached token permissions could carry over to another user’s token with the same scopes.

UI Icons, 12,471 sites. Two advisories, one Critical. Both are fixed in 2.0.2 or 1.1.3.

Domain, 12,188 sites. SA-CONTRIB-2026-238 affects only the 3.0.x branch, and only with the per-content-type grants setting on. The advisory says that setting is off by default.

How to check which Drupal contrib advisories apply to your sites

You need a list of what each site runs. There are three ways to get it.

Drush. Run drush pm:list --no-core --status=enabled. The Drush pm:list documentation lists those options. Leave off --type=module this time. Bootstrap, ABC, Black Hole, Zero Point and Ágora are themes, and a module-only list will miss them.

Composer. Run composer outdated "drupal/*", the command in drupal.org’s Composer update guide. Then update with composer update drupal/modulename --with-all-dependencies, run drush updatedb and drush cache:rebuild.

The admin screen. With the core Update Status module turned on, go to Reports, then Available updates, the path in Drupal’s user guide on updating a module. The Update Status documentation says the site can check for updates once a day or once a week.

The machine names to search for:

ffmpeg_image_toolkit, custom_formatters, ui_icons, zeropoint, black_hole, abc, monster_menus, dopup, csv_field, swiper_formatter, sector, uswds_paragraph_components, simple_user_management, agora_theme, block_attributes, view_unpublished, bootstrap, shield, domain_login_restrict, datafield, doccheck_basic, domain, frontend_editing, simple_oauth, media_bulk_upload, fullcalendar_view, ai_file_to_text, rabbit_hole, media_alias_display, tinypng, imageapi_optimize_webp.

What to do if a module or branch is unsupported

Three of these Drupal contrib advisories name branches that get no security fixes. The UI Icons, CSV Field and ImageAPI Optimize WebP advisories say UI Icons 1.0.x, CSV Field 1.0.x and ImageAPI Optimize WebP 2.0.x are unsupported. Moving to a supported branch is the fix. As of October 23, the UI Icons project page also lists 2.0.x as no longer supported, after a 2.1.0 release on October 22.

A whole project can also be marked unsupported. Drupal’s security team procedure for marking a project unsupported says this can happen when maintainers do not respond to repeated contact. The warning it adds to the project page lists the options: choose another actively maintained module, take over through the unsupported project process, or hire someone to fix the bug so the module can be published again.

Either way, move to a supported branch if one exists. If not, replace or uninstall the module.

Drupal 10 end of life and these fixes

Some of these fixes already show it. Bootstrap’s project page lists 8.x-3.45 as working with Drupal 10.5 or newer, 11.2 or newer, and 12, so older Drupal 10 sites need a core update first. Simple OAuth’s project page says its 5.2 branch reaches end of life on December 9, 2026, aligned with Drupal 10. Background is in what Drupal 10 end of life means for your site and our plain-language Webform guide.

Drupal’s PSA-2026-10-20 flagged PHP’s critical security release of October 21. PHP’s news archive lists the fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The researchers named the two flaws PHP2Shell, and our PHP2Shell post covers them.

A patch order for this week

This is the order we would use for the October 21 Drupal contrib advisories.

1. Ffmpeg Image Toolkit to 1.0.3, today, if you run it.
2. Dopup, which needs no login, then Custom Formatters, UI Icons, the three themes and Monster Menus.
3. The widely used Moderately critical modules: Bootstrap, Rabbit Hole, Shield, Simple OAuth and Domain.
4. The rest of the list, matched against each advisory’s conditions.
5. Unsupported branches, moved to a supported one.

Patch on staging first. If core is also behind, the October 14 core release comes first, and our Upgrade Status guide helps plan the Drupal 11 move.

Frequently Asked Questions