Vulnerability DRUPAL-CONTRIB-2026-293
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 hours ago
November 04, 2026 at 05:29 PM UTC
No summary available
<4.1.1
<4.1.1
Details
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.
A maliciously crafted import file can cause untrusted data to be deserialized (PHP Object Injection, CWE-502), potentially leading to remote code execution.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Impacted packages
Timeline
Published
4 hours ago
November 04, 2026 at 05:29 PM UTC
Last Modified
1 hour ago
November 04, 2026 at 08:30 PM UTC