CVE-2026-118561
Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
- Record
CVE-2026-118561- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-06
EUVDEUVD-2026-113498
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
- Record
EUVD-2026-113498- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-pr3q-r52j-2fc8
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path...
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
- Record
GHSA-pr3q-r52j-2fc8- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-06
NVD
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
- Record
CVE-2026-118561- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-06
OSV
Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
- Record
CVE-2026-118561- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-07
OSVDRUPAL-CONTRIB-2026-274 No score
Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites.
The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the web server, or cause the server to make requests to internal or external resources. Depending on the server configuration, this may lead to remote code execution.
Exploitation requires the import single content permission. This permission is marked as restricted starting with version 1.4.18. Remote code execution additionally depends on the server permitting execution of attacker-controlled files.
- Record
DRUPAL-CONTRIB-2026-274- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/single_content_syncPackagist:https://packages.drupal.org/8 |
before 1.4.19 | 1.4.19 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts, severity | CVE List, EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-118561 is a high vulnerability (CVSS 7.2) in Drupal Single Content Sync, published October 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in drupal/single_content_sync 1.4.19.