CVE-2026-118547 Drupal CVE debrief

Who should care

Drupal site administrators and security teams should assess exposure and apply patches for the Content Synchronizer module, particularly for sites using versions less than 4.1.1. They should verify if the Content Synchronizer module is used and if the version is less than 4.1.1. They should also monitor for suspicious import file activity and review and restrict import file sources and validation.

Why it matters

CVE-2026-118547 is a vulnerability in the Content Synchronizer module for Drupal that allows for PHP Object Injection via maliciously crafted import files, potentially leading to remote code execution. Defenders should prioritize verifying exposure and applying patches, particularly for Drupal sites using versions less than 4.1.1.

• Verify exposure of Drupal sites using Content Synchronizer module versions less than 4.1.1.
• Apply patches or updates to prevent potential remote code execution.
• Monitor for suspicious import file activity.
• Review and restrict import file sources and validation.

Technical summary

The Content Synchronizer module for Drupal allows content to be exported and imported between sites via uploaded archive files. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution via PHP Object Injection. This issue affects versions less than 4.1.1. The vulnerability is related to the deserialization of untrusted data, which can lead to remote code execution. Defenders should prioritize verifying exposure and applying patches for the Content Synchronizer module, particularly for Drupal sites using versions less than 4.1.1.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for the Content Synchronizer module, particularly for Drupal sites using versions less than 4.1.1.

Recommended defensive actions

• Verify if the Content Synchronizer module is used and if the version is less than 4.1.1.
• Apply patches or updates to bring the Content Synchronizer module to version 4.1.1 or higher.
• Monitor for suspicious import file activity.
• Review and restrict import file sources and validation.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability is described in the source item from osv_dev and is related to PHP Object Injection via malicious import files. The CVE Program and NVD provide additional context. The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution via PHP Object Injection. Defenders should verify exposure and apply patches for the Content Synchronizer, and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.