CVE-2026-118547DRUPAL-CONTRIB-2026-293
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.
A maliciously crafted import file can cause untrusted data to be deserialized (PHP Object Injection, CWE-502), potentially leading to remote code execution.
AI analysis
Not analysed yet.
Claude analyses new vulnerabilities after each morning's collection, most important first, up to a daily limit. The verified data on this page is complete without it.
| Product | Affected versions | Fixed in | Source |
|---|---|---|---|
| drupal/content_synchronizerPackagist:https://packages.drupal.org/8 | < 4.1.1 | 4.1.1 | OSV |
No weakness classification (CWE) has been assigned yet.
Published
First publication at the source
Last modified
Latest change at the source
Collected
First seen by Baba Yaga Security