SA-CONTRIB-2026-275: Critical severity composer/drupal/single_content_sync vulnerability
Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution. This vulnerability is mitigated by the fact that an attacker must have a role with the "import single content" permission.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/single_content_syncto a version that resolves this vulnerability.Fixed in 1.4.19
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs a role that has the "import single content" permission. The issue is therefore mitigated where untrusted users cannot import Single Content Sync files.
What does an attacker need to provide?
The attacker must be able to submit a maliciously crafted import file through the Single Content Sync import capability. That file can cause untrusted data to be deserialized, potentially resulting in remote code execution.