{"id":"DRUPAL-CONTRIB-2026-285","details":"This module enables users to create and save signatures as SVG images.\n\nThe module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in a cross-site scripting (XSS) vulnerability.","aliases":["CVE-2026-118575"],"modified":"2026-10-28T18:15:03.732769951Z","published":"2026-10-28T17:36:44Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-285"}],"affected":[{"package":{"name":"drupal/sign_widget","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/sign_widget?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0"}],"database_specific":{"constraint":"\u003c1.15.0"}}],"database_specific":{"affected_versions":"\u003c1.15.0","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/sign_widget/DRUPAL-CONTRIB-2026-285.json"}}],"schema_version":"1.9.2","credits":[{"name":"Marcus Johansson (marcus_johansson)","contact":["https://www.drupal.org/u/marcus_johansson"]},{"name":"Ra Mänd (ram4nd)","contact":["https://www.drupal.org/u/ram4nd"]}]}