Live › vulnerability › CVE-2026-118561
Drupal Single Content Sync versions up to and including 1.4.19 let a file name or path be controlled from outside, enabling path traversal. An attacker could potentially read or write files outside the intended directory on the site's server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that have the Single Content Sync module installed at version 1.4.19 or earlier are in the affected range. The sources do not say which module features or configurations are needed to reach the flaw, or whether anonymous users can trigger it.
No product ranges from the sources yet.
composer show drupal/single_content_sync or the Extend page in the admin UI).1.4.19 or lower, the site is in the affected range.1.4.19; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
This page as .md · .json · in your agent: get_signal("CVE-2026-118561")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.