---
id: "CVE-2026-118562"
kind: "vulnerability"
aliases: ["CVE-2026-118562"]
title: "Drupal Single Content Sync: untrusted data deserialization allows object injection"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "php", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:18:21+00:00"
first_seen_at: "2026-10-30T04:28:39+00:00"
updated_at: "2026-10-30T04:29:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118562", "first_seen_at": "2026-10-30T04:28:39+00:00"}]
---

# Drupal Single Content Sync: untrusted data deserialization allows object injection

Drupal's Single Content Sync module deserializes untrusted data, which allows object injection. The sources do not state what an attacker gets beyond that, so the worst case is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the `drupal/single_content_sync` module with `composer show drupal/single_content_sync` on the Drupal site.
- Versions up to `1.4.19` are listed as affected.

## Timeline

- 2026-10-30T04:28:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118562

## From the sources

Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_