← CVE index
Vulnerability record/PUBLISHED/Published Oct 30, 2026 03:08:50 UTC

CVE-2026-118562

Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

Base score7.2/ 10
SeverityHighCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredHighPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactHighC
Integrity impactHighI
Availability impactHighA
CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritydrupal
Last updatedNov 6, 2026 13:41:36 UTC
PublishedOct 30, 2026 03:08:50 UTC
ReservedOct 28, 2026 15:50:46 UTC

Credits

  • Drew Webber (mcdruid)
  • Drew Webber (mcdruid)
  • Oleksandr Kuzava (nginex)
  • Swan Kalata (akalata)
  • Greg Knaddison (greggles)
  • Lee Rowlands (larowlan)
  • Drew Webber (mcdruid)
  • Juraj Nemec (poker10)
  • Jess (xjm)