{"id":"DRUPAL-CONTRIB-2026-293","details":"The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.\n\nA maliciously crafted import file can cause untrusted data to be deserialized (PHP Object Injection, CWE-502), potentially leading to remote code execution.","aliases":["CVE-2026-118547"],"modified":"2026-11-04T20:30:02.728771908Z","published":"2026-11-04T17:29:01Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-293"}],"affected":[{"package":{"name":"drupal/content_synchronizer","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/content_synchronizer?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1"}],"database_specific":{"constraint":"\u003c4.1.1"}}],"database_specific":{"affected_versions":"\u003c4.1.1","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/content_synchronizer/DRUPAL-CONTRIB-2026-293.json"}}],"schema_version":"1.9.2","credits":[{"name":"Drew Webber (mcdruid)","contact":["https://www.drupal.org/u/mcdruid"]}]}