CVE-2026-118561
Low risk· EPSS 4%Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Single Content Sync module for Drupal contains an External Control of File Name or Path vulnerability that allows Path Traversal. The issue affects versions from 0.0.0 to 1.4.19.
Risk Assessment
An attacker could manipulate file paths to access files outside the intended directory, potentially exposing or overwriting sensitive data. This may compromise the confidentiality and integrity of the site.
Recommendation
Update the Single Content Sync module to a version later than 1.4.19. Review permissions on synchronization directories and restrict access to import/export features.
Other vulnerabilities in Drupal Single Content Sync
Original NVD description (English source)
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS