- Package
- drupal/single_content_sync
- Fixed in
- 1.4.19
- Published
- Wed 28 Oct 2026, 17:17 Lisbon
In plain words
A maliciously crafted import file can cause Single Content Sync to deserialise untrusted data, potentially allowing remote code execution. An attacker must have a role with the import single content permission.
Am I affected?
Look for drupal/single_content_sync and its installed version in composer.lock. Version 1.4.19 contains the fix; the advisory does not specify an affected version range. Check which Drupal roles have the import single content permission.
What to do
Check which version you have, then update to a fixed release for your branch (1.4.19):
composer show drupal/single_content_sync | grep versions
composer update drupal/single_content_syncIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The vulnerability is mitigated by the requirement that an attacker have a role with the import single content permission.
The advisory's description
Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites.
A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution.
This vulnerability is mitigated by the fact that an attacker must have a role with the "import single content" permission.