CVE-2026-118566 json
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.
published 2026-11-04 4 d ago modified 2026-11-04 4 d ago also DRUPAL-CONTRIB-2026-294
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.
The module doesn't sufficiently sanitize input passed to its client-side code, leading to a DOM-based cross-site scripting (XSS) vulnerability.
Patch / fix
- packagist drupal/content_synchronizer 4.1.1
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | drupal/content_synchronizer | <4.1.1 |
4.1.1 |
References
Sources
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.