Threats affecting pkg:composer/drupal/single_content_sync

A deserialization of untrusted data vulnerability (CWE-502) exists in Drupal Single Content Sync versions from 0.0.0 up to but not including 1.4.19. This flaw allows object injection, which can lead to security issues. The vulnerability was fixed in version 1.4.19.

The Single Content Sync module for Drupal allows exporting and importing content, referenced entities, and files between Drupal sites. A vulnerability exists due to insufficient validation of file sources and destinations during content imports, which can enable an attacker with the import permission to write arbitrary files, disclose sensitive files accessible to the web server, or cause the server to make requests to internal or external resources. This may lead to remote code execution depending on server configuration and permissions. The import single content permission is required for exploitation and is restricted starting with version 1.4.18. The issue is fixed in version 1.4.19.