{"id":"CVE-2026-118562","aliases":["DRUPAL-CONTRIB-2026-275","EUVD-2026-113497","GHSA-8c38-6hgm-65rx"],"status":"published","title":"Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275","description":"Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00322,"percentile":0.25534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2026-10-28T17:17:38Z","modified":"2026-11-06T13:41:36Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/single_content_sync","fixed_in":["1.4.19"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/single_content_sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.19"}]}]}],"products":[{"vendor":"drupal","product":"single content sync"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-275","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118562","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8c38-6hgm-65rx"},{"url":"https://git.drupalcode.org/project/single_content_sync","tags":["web"]},{"url":"https://www.drupal.org/project/single_content_sync","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118562.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-118562","title":"Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275","description":"Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.","status":"published","published":"2026-10-30T03:08:50.773Z","modified":"2026-11-06T13:41:36.236Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-06T14:58:28.173309Z"}],"euvd":[{"id":"EUVD-2026-113497","description":"Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.","status":"published","published":"2026-10-30T03:08:50Z","modified":"2026-11-06T13:41:36Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T15:05:10.688381Z"}],"ghsa":[{"id":"GHSA-8c38-6hgm-65rx","title":"Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object...","description":"Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.","status":"published","published":"2026-10-30T06:31:59Z","modified":"2026-11-06T15:31:19Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-06T16:00:40.695019Z"}],"nvd":[{"id":"CVE-2026-118562","description":"Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.","status":"published","published":"2026-10-30T04:18:21.99Z","modified":"2026-11-06T14:17:08.61Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-06T16:00:35.469074Z"}],"osv":[{"id":"CVE-2026-118562","title":"Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275","description":"Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.","status":"published","published":"2026-10-30T03:08:50.773Z","modified":"2026-11-08T02:30:24.431957066Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-07T03:08:01.41647Z"},{"id":"DRUPAL-CONTRIB-2026-275","description":"Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites.\n\nA maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the \"import single content\" permission.","status":"published","published":"2026-10-28T17:17:38Z","modified":"2026-10-28T18:15:05.531003045Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}