Is CVE-2026-118561 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118561 being exploited in the wild.

How severe is CVE-2026-118561?

Informational severity, published 30 October 2026.

How is CVE-2026-118561 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118561?

Check whether you run Drupal Single Content Sync or Packagist:Https://Packages.Drupal.Org/8 Drupal/Single Content Sync at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118561: Drupal Single Content Sync arbitrary file write and disclosure

CVE-2026-118561 · Severity: info · Published 2026-10-30

Single Content Sync is a Drupal module that imports and exports content and files between sites. The module fails to properly validate where files come from and go during imports, allowing an authenticated attacker with the import permission to write arbitrary files to the server, read sensitive files, trigger outbound requests, or potentially execute code. This poses a significant risk if the web server is configured to execute files in writable directories.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Single Content Sync. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-118561 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118561 being exploited in the wild.
How severe is CVE-2026-118561?: Informational severity, published 30 October 2026.
Which products and versions are affected?: Drupal Single Content Sync before 1.4.19; Packagist:Https://Packages.Drupal.Org/8 Drupal/Single Content Sync ECOSYSTEM:introduced=0,fixed=1.4.19.
Is there a fix for CVE-2026-118561?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Single Content Sync: upgrade to 1.4.19 or later. Until then: Restrict the "import single content" permission to trusted users only; this permission is marked as restricted by default in version 1.4.18 and later, limiting access to site administrators. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118561 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118561?: Check whether you run Drupal Single Content Sync or Packagist:Https://Packages.Drupal.Org/8 Drupal/Single Content Sync at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Single Content Sync: upgrade to 1.4.19 or later

Restrict the "import single content" permission to trusted users only; this permission is marked as restricted by default in version 1.4.18 and later, limiting access to site administrators.

Technical details

The module does not sufficiently validate file sources and destinations during content import operations, allowing path traversal or arbitrary file write attacks. An attacker with the "import single content" permission can write files to arbitrary locations, disclose files readable by the web server process, or cause server-side request forgery (SSRF) attacks. Remote code execution is possible if the server permits execution of attacker-written files in the target directory.

Affected products

Drupal Single Content Sync before 1.4.19

Identifiers

CVE-2026-118561
DRUPAL-CONTRIB-2026-274

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.