DRUPAL-CONTRIB-2026-285

Import Source

https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/sign_widget/DRUPAL-CONTRIB-2026-285.json

JSON Data

https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-285

Aliases

CVE-2026-118575

Published

2026-10-28T17:36:44Z

Modified

2026-10-28T18:15:03Z

Summary

[none]

Details

This module enables users to create and save signatures as SVG images.

The module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in a cross-site scripting (XSS) vulnerability.

References

https://www.drupal.org/sa-contrib-2026-285

Credits

- Marcus Johansson (marcus_johansson)
- - https://www.drupal.org/u/marcus_johansson
- Ra Mänd (ram4nd)
- - https://www.drupal.org/u/ram4nd

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/sign_widget

Package

Name: drupal/sign_widget
Purl: pkg:composer/drupal/sign_widget?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

1.15.0

Database specific

Show details

{
    "constraint":  "<1.15.0"
}

Database specific

affected_versions

"<1.15.0"

source

"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/sign_widget/DRUPAL-CONTRIB-2026-285.json"