- Package
- drupal/single_content_sync
- Fixed in
- 1.4.19
- Published
- Wed 28 Oct 2026, 17:17 LisbonUpdated Mon 2 Nov 2026, 07:26 Lisbon
In plain words
Single Content Sync does not sufficiently validate file sources and destinations during content imports. An attacker with the import single content permission can write arbitrary files, read sensitive local files accessible to the web server, or make the server request internal or external resources. This may also allow remote code execution if the server permits execution of attacker-controlled files.
Am I affected?
Find drupal/single_content_sync and its version in composer.lock. The advisory lists 1.4.19 as fixed but gives no affected version range. Check who has the import single content permission, which is marked as restricted starting with 1.4.18. Remote code execution additionally depends on whether your server permits execution of attacker-controlled files.
What to do
Check which version you have, then update to a fixed release for your branch (1.4.19):
composer show drupal/single_content_sync | grep versions
composer update drupal/single_content_syncIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites.
The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the web server, or cause the server to make requests to internal or external resources. Depending on the server configuration, this may lead to remote code execution.
Exploitation requires the import single content permission. This permission is marked as restricted starting with version 1.4.18. Remote code execution additionally depends on the server permitting execution of attacker-controlled files.