Project:
Project machine name:
single_content_syncDate:
2026-October-28
Vulnerability:
Remote code execution
Affected versions:
<1.4.19
CVE IDs:
CVE-2026-118562
Description:
Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites.
A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution.
This vulnerability is mitigated by the fact that an attacker must have a role with the "import single content" permission.
Solution:
Install the latest version:
- Upgrade to Single Content Sync 1.4.19.
Reported By:
- Drew Webber (mcdruid) of the Drupal Security Team
Fixed By:
- Drew Webber (mcdruid) of the Drupal Security Team
- Oleksandr Kuzava (nginex)
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
