DRUPAL-CONTRIB-2026-285: XSS

Q: Which deployments are exposed to this issue?

Deployments using the sign_widget module are exposed where users can create and save SVG signatures and the resulting files are saved to the public file system.

Q: What would an attacker need to exploit it?

An attacker would need a way to submit a maliciously crafted signature file or SVG content through the module's signature-creation functionality. The unsafe content must then be saved to the public file system.

Q: How can I determine whether my site may be affected?

Check whether composer/drupal/sign_widget is installed and whether it is used to accept and save user-created SVG signatures in the public file system. Review saved signature SVG files for active or otherwise unsafe content.

Published Oct 28, 2026

Updated

This module enables users to create and save signatures as SVG images.

The module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in a cross-site scripting (XSS) vulnerability.

Affected Software

1 affected componentFixes available

composer/drupal/sign_widget<1.15.0

1.15.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/sign_widget to a version that resolves this vulnerability.
Fixed in 1.15.0

Event History

Oct 28, 2026

Advisory Published

via OSV·05:36 PM

Data Sourced

via OSV·05:36 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the sign_widget module are exposed where users can create and save SVG signatures and the resulting files are saved to the public file system.

What would an attacker need to exploit it?

An attacker would need a way to submit a maliciously crafted signature file or SVG content through the module's signature-creation functionality. The unsafe content must then be saved to the public file system.

How can I determine whether my site may be affected?

Check whether composer/drupal/sign_widget is installed and whether it is used to accept and save user-created SVG signatures in the public file system. Review saved signature SVG files for active or otherwise unsafe content.

DRUPAL-CONTRIB-2026-285: XSS

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What would an attacker need to exploit it?

How can I determine whether my site may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What would an attacker need to exploit it?

How can I determine whether my site may be affected?