← CVE index
Vulnerability record/PUBLISHED/Published Oct 30, 2026 03:08:51 UTC

CVE-2026-118561

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

Base score7.2/ 10
SeverityHighCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredHighPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactHighC
Integrity impactHighI
Availability impactHighA
CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritydrupal
Last updatedNov 6, 2026 13:43:00 UTC
PublishedOct 30, 2026 03:08:51 UTC
ReservedOct 28, 2026 15:50:46 UTC

Credits

  • jvdkolk
  • killianacc
  • Kévin Le lostec (klelostec)
  • nicocha30
  • killianacc
  • Oleksandr Kuzava (nginex)
  • Swan Kalata (akalata)
  • Greg Knaddison (greggles)
  • Juraj Nemec (poker10)
  • Jess (xjm)