Oleksandr Kuzava

Single Content Sync allows exporting and importing content, referenced entities, and files between Drupal sites. The module fails to sufficiently validate file sources and destinations during content imports, leading to Path Traversal. This allows an attacker to write arbitrary files, disclose sensitive local files accessible to the web server, or trigger requests to internal or external resources. Depending on server configuration, this may result in remote code execution. Exploitation requires the *import single content* permission.

Single Content Sync allows exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution via Object Injection. This issue requires the attacker to possess a role with the "import single content" permission.

An incorrect authorization issue allows forceful browsing. In multilingual sites, for nodes containing at least one unpublished translation, the module grants view access to the published translations of that node to any user with the "access content" permission. This action overrides restrictions established by other node access modules, such as Content Access or Domain Access, which may have been intended to restrict access to those specific translations.

The issue is related to a Missing Authorization vulnerability in Drupal Single Content Sync, which allows functionality misuse.