Unscored

CVE-2026-118561Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

Drupal Single Content Sync Published: 2026-10-30 06:08 (4 days ago)

Description

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

Weakness (CWE): CWE-73

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Drupal	Single Content Sync	0.0.0 – < 1.4.19

References and patches

https://www.drupal.org/sa-contrib-2026-274

CVSS score

Not scored yet. It appears here once the CNA, CISA or NVD scores it.

EPSS (chance of exploitation in 30 days)

0.15%

higher than 4% of all CVEs

Timeline

ID reserved2026-10-28
Published2026-10-30 06:08
Reached IP-DB2026-10-30 07:03
Last updated2026-10-30 22:27

Assigned by (CNA): drupal
NVD status: Awaiting Analysis

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time