Project: 
Content Synchronizer
Project machine name: 
content_synchronizer
Date: 
2026-November-04
Security risk: 
Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross-site scripting
Affected versions: 
<4.1.1
CVE IDs: 
CVE-2026-118566
Description: 

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.

The module doesn't sufficiently sanitize input passed to its client-side code, leading to a DOM-based cross-site scripting (XSS) vulnerability.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: