PT-2026-130590

CVE-2026-118562

Published

2026-10-28

Updated

2026-10-30

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Single Content Sync versions 0.0.0 through 1.4.19

Description Single Content Sync allows exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution via Object Injection. This issue requires the attacker to possess a role with the "import single content" permission.

Recommendations Update Single Content Sync to a version later than 1.4.19.

Exploitability

Exploit

Fix

Impacts

Researchers