{"id":"DRUPAL-CONTRIB-2026-275","details":"Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites.\n\nA maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the \"import single content\" permission.","aliases":["CVE-2026-118562"],"modified":"2026-10-28T18:15:05.531003045Z","published":"2026-10-28T17:17:38Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-275"}],"affected":[{"package":{"name":"drupal/single_content_sync","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/single_content_sync?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.19"}],"database_specific":{"constraint":"\u003c1.4.19"}}],"database_specific":{"source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/single_content_sync/DRUPAL-CONTRIB-2026-275.json","affected_versions":"\u003c1.4.19"}}],"schema_version":"1.9.2","credits":[{"name":"Drew Webber (mcdruid)","contact":["https://www.drupal.org/u/mcdruid"]}]}