SA-CONTRIB-2026-293: Critical severity composer/drupal/content_synchronizer vulnerability
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files. A maliciously crafted import file can cause untrusted data to be deserialized (PHP Object Injection, CWE-502), potentially leading to remote code execution.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/content_synchronizerto a version that resolves this vulnerability.Fixed in 4.1.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Drupal sites using the Content Synchronizer module's archive-file import capability are exposed when they process imported archive files.
What does an attacker need to exploit this issue?
An attacker needs a maliciously crafted import archive file to be processed by the module. Processing that file can deserialize untrusted data and may lead to remote code execution.