DRUPAL-CONTRIB-2026-275: Composer/drupal/single_content_sync vulnerability

Q: Who can exploit this issue?

An attacker needs a Drupal role that has the "import single content" permission. The available information does not indicate that unauthenticated users or users without that permission can trigger the vulnerable import path.

Published Oct 28, 2026

Updated

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites.

A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution.

This vulnerability is mitigated by the fact that an attacker must have a role with the "import single content" permission.

Affected Software

1 affected componentFixes available

composer/drupal/single_content_sync<1.4.19

1.4.19

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/single_content_sync to a version that resolves this vulnerability.
Fixed in 1.4.19

Event History

Oct 28, 2026

Advisory Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker needs a Drupal role that has the "import single content" permission. The available information does not indicate that unauthenticated users or users without that permission can trigger the vulnerable import path.

What capability could successful exploitation provide?

A maliciously crafted import file can cause untrusted data to be deserialized. This could potentially result in remote code execution.

DRUPAL-CONTRIB-2026-275: Composer/drupal/single_content_sync vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What capability could successful exploitation provide?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What capability could successful exploitation provide?