CVE-2026-118562
Low risk· EPSS 19%Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Single Content Sync module for Drupal contains a Deserialization of Untrusted Data vulnerability that allows Object Injection. The issue affects versions from 0.0.0 to 1.4.19.
Risk Assessment
An attacker could supply crafted data that, when deserialized, leads to dangerous operations, potentially including remote code execution. This could result in full compromise of the site.
Recommendation
Update the Single Content Sync module to a version later than 1.4.19. Until then, restrict access to content synchronization features to trusted users.
Other vulnerabilities in Drupal Single Content Sync
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS