DRUPAL-CONTRIB-2026-293: Composer/drupal/content_synchronizer vulnerability

Q: Which deployments are exposed?

Drupal sites using the Content Synchronizer module are exposed when they process content imports from uploaded archive files.

Q: What does an attacker need to exploit this issue?

An attacker needs a maliciously crafted import archive to be processed by the module. Processing the file can deserialize untrusted data and may lead to remote code execution.

Published Nov 4, 2026

Updated

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.

A maliciously crafted import file can cause untrusted data to be deserialized (PHP Object Injection, CWE-502), potentially leading to remote code execution.

Affected Software

1 affected componentFixes available

composer/drupal/content_synchronizer<4.1.1

4.1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/content_synchronizer to a version that resolves this vulnerability.
Fixed in 4.1.1

Event History

Nov 4, 2026

Advisory Published

via OSV·05:29 PM

Data Sourced

via OSV·05:29 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed?

Drupal sites using the Content Synchronizer module are exposed when they process content imports from uploaded archive files.

What does an attacker need to exploit this issue?

An attacker needs a maliciously crafted import archive to be processed by the module. Processing the file can deserialize untrusted data and may lead to remote code execution.