CVE-2026-118547: Composer/drupal/content_synchronizer vulnerability

Q: Which deployments are exposed?

Drupal sites that use the Content Synchronizer module to import content from uploaded archive files are exposed to this issue.

Q: What does an attacker need to exploit it?

An attacker needs a maliciously crafted import archive to be processed by the Content Synchronizer import function. Processing the file can deserialize untrusted data and may lead to remote code execution.

Published Nov 4, 2026

Updated

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.

A maliciously crafted import file can cause untrusted data to be deserialized (PHP Object Injection, CWE-502), potentially leading to remote code execution.

Affected Software

1 affected componentFixes available

composer/drupal/content_synchronizer<4.1.1

4.1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/content_synchronizer to a version that resolves this vulnerability.
Fixed in 4.1.1

Event History

Nov 4, 2026

Advisory Published

via OSV·05:29 PM

Data Sourced

via OSV·05:29 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed?

Drupal sites that use the Content Synchronizer module to import content from uploaded archive files are exposed to this issue.

What does an attacker need to exploit it?

An attacker needs a maliciously crafted import archive to be processed by the Content Synchronizer import function. Processing the file can deserialize untrusted data and may lead to remote code execution.