Project:
Project machine name:
sign_widgetDate:
2026-October-28
Vulnerability:
Cross-site scripting
Affected versions:
<1.15.0
CVE IDs:
CVE-2026-118575
Description:
This module enables users to create and save signatures as SVG images.
The module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in a cross-site scripting (XSS) vulnerability.
Solution:
Install the latest version:
- If you use the sign_widget module for Drupal 10.x/11.x, upgrade to Sign Widget 8.x-1.15
Reported By:
- Marcus Johansson (marcus_johansson)
- Ra Mänd (ram4nd), provisional member of the Drupal Security Team
Fixed By:
- Joseph Olstad (joseph.olstad)
- Marcus Johansson (marcus_johansson)
- Ra Mänd (ram4nd), provisional member of the Drupal Security Team
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Heine Deelstra (heine) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
