Search

Find a vulnerability

Search criteria

    Related vulnerabilities

    DRUPAL-CONTRIB-2026-294 (CVE-2026-118566)

    Vulnerability from drupal – Published: 2026-11-04 17:29 – Updated: 2026-11-04 17:56 – Source website
    VLAI
    Details

    The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.

    The module doesn't sufficiently sanitize input passed to its client-side code, leading to a DOM-based cross-site scripting (XSS) vulnerability.

    Credits
    Drew Webber (mcdruid) www.drupal.org/u/mcdruid
    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c4.1.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/content_synchronizer"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c4.1.1"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-118566"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/mcdruid"
      ],
      "name": "Drew Webber (mcdruid)"
    }
  ],
  "details": "The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.\n\nThe module doesn\u0027t sufficiently sanitize input passed to its client-side code, leading to a DOM-based cross-site scripting (XSS) vulnerability.",
  "id": "DRUPAL-CONTRIB-2026-294",
  "modified": "2026-11-04T17:56:34.000Z",
  "published": "2026-11-04T17:29:31.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-294"
    }
  ],
  "schema_version": "1.7.0"
}