Project:
Project machine name:
content_synchronizerDate:
2026-November-04
Vulnerability:
Remote code execution
Affected versions:
<4.1.1
CVE IDs:
CVE-2026-118547
Description:
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.
A maliciously crafted import file can cause untrusted data to be deserialized (PHP Object Injection, CWE-502), potentially leading to remote code execution.
Solution:
Install the latest version:
- Upgrade to Content Synchronizer 4.1.1.
Reported By:
- Drew Webber (mcdruid) of the Drupal Security Team
Fixed By:
- Oleh Shevchuk (alt.dev)
- Bohdan Artemchuk (bohart)
- Drew Webber (mcdruid) of the Drupal Security Team
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
