Path Traversal Vulnerability in Drupal Single Content Sync Plugin
CVE-2026-118561

7.2HIGH

Key Information:

Vendor

Drupal
Status
Single Content Sync
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118561?

The Drupal Single Content Sync plugin has a vulnerability that allows external control of file names or paths, leading to a path traversal exploit. This security flaw could enable unauthorized access to file system resources, potentially compromising sensitive data and the overall integrity of the Drupal environment. All versions from 0.0.0 to 1.4.19 are affected, highlighting the importance of updating to secure versions and enhancing overall security measures.

Affected Version(s)

Single Content Sync 0.0.0 < 1.4.19

References

https://www.drupal.org/sa-contrib-2026-274

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

jvdkolk
killianacc
Kévin Le lostec (klelostec)
nicocha30
killianacc
Oleksandr Kuzava (nginex)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
.