---
id: "CVE-2026-118568"
kind: "vulnerability"
aliases: ["CVE-2026-118568"]
title: "Drupal Content Sync: insecure storage exposes embedded sensitive data"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["content-sync", "drupal", "package", "php"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:18:22+00:00"
first_seen_at: "2026-10-30T04:28:39+00:00"
updated_at: "2026-10-30T04:29:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118568", "first_seen_at": "2026-10-30T04:28:39+00:00"}]
---

# Drupal Content Sync: insecure storage exposes embedded sensitive data

Drupal Content Sync stores sensitive information in an insecure way, so data embedded in exported content can be retrieved. The sources do not say what the data is or what access an attacker needs to read it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Content Sync version with `drush pm:list --filter=content_sync` on a Drupal site.
- Look for Content Sync in the Drupal `composer.lock` file and note the `drupal/content_sync` version.

## Fix

- Content Sync versions from 0.0.0 to `3.2.2` are affected; the sources do not name a fixed version.

## Timeline

- 2026-10-30T04:28:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118568

## From the sources

Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_