Skip to content
OpenAdvisories
Unscored CVE-2026-118566 DRUPAL-CONTRIB-2026-294

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files. The module does…

Published Nov 4, 2026 · Updated Nov 4, 2026 · Assigned by DRUPAL

Package: drupal/content_synchronizer Ecosystem: Packagist

Description

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.

The module doesn't sufficiently sanitize input passed to its client-side code, leading to a DOM-based cross-site scripting (XSS) vulnerability.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/content_synchronizer < 4.1.1 4.1.1 DRUPAL-CONTRIB-2026-294

Advisories 1

References