{"id":"CVE-2026-118561","kind":"vulnerability","aliases":["CVE-2026-118561"],"related":[],"title":"Drupal Single Content Sync: path traversal in file handling, versions through 1.4.19","description":"External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.","summary":"Drupal Single Content Sync versions up to and including 1.4.19 let a file name or path be controlled from outside, enabling path traversal. An attacker could potentially read or write files outside the intended directory on the site's server.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","single-content-sync"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Single Content Sync module in the Drupal project (for example with `composer show drupal/single_content_sync` or the Extend page in the admin UI).\n- If the installed version is `1.4.19` or lower, the site is in the affected range.","fix":"- Move to a Single Content Sync release newer than `1.4.19`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-30T04:18:21+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:16+00:00","updated_at":"2026-10-30T04:29:16+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:16Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Single Content Sync release newer than `1.4.19`; the exact fixed version is unknown from the sources.","reach":"unknown","title":"Drupal Single Content Sync: path traversal in file handling, versions through 1.4.19","impact":"medium","summary":"Drupal Single Content Sync versions up to and including 1.4.19 let a file name or path be controlled from outside, enabling path traversal. An attacker could potentially read or write files outside the intended directory on the site's server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","single-content-sync","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads or writes files outside the intended directory","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version, required permissions, and whether the traversal is read or write.","how_to_check":"- Check the installed version of the Single Content Sync module in the Drupal project (for example with `composer show drupal/single_content_sync` or the Extend page in the admin UI).\n- If the installed version is `1.4.19` or lower, the site is in the affected range.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that have the Single Content Sync module installed at version 1.4.19 or earlier are in the affected range. The sources do not say which module features or configurations are needed to reach the flaw, or whether anonymous users can trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000695,"input_tokens":4082,"output_tokens":574,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118561':15A,18A '-2026':14A,17A '0.0.0':92C '1.4.19':12A,37B,94C 'affect':86C 'allow':81C 'attack':52B 'content':3A,26B,30B,79C,88C 'control':45B,69C 'could':53B 'cve':13A,16A 'directori':62B 'drupal':1A,19B,28B,77C 'enabl':48B 'extern':68C 'file':8A,40B,58B,71C 'handl':9A 'host':23B 'includ':36B 'intend':61B 'issu':85C 'let':38B 'name':41B,72C 'outsid':47B,59B 'packag':20B 'path':5A,43B,49B,74C,82C 'potenti':54B 'read':55B 'self':22B 'self-host':21B 'server':67B 'singl':2A,25B,29B,78C,87C 'single-content-sync':24B 'site':65B 'sync':4A,27B,31B,80C,89C 'travers':6A,50B,83C 'version':10A,32B,90C 'vulner':75C 'write':57B","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that have the Single Content Sync module installed at version 1.4.19 or earlier are in the affected range. The sources do not say which module features or configurations are needed to reach the flaw, or whether anonymous users can trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118561","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118561","severity":null,"published_at":"2026-10-30T04:18:21+00:00","modified_at":"2026-10-30T04:18:21+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}