SA-CONTRIB-2026-285: XSS
This module enables users to create and save signatures as SVG images. The module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in a cross-site scripting (XSS) vulnerability.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/sign_widgetto a version that resolves this vulnerability.Fixed in 8.x-1.15
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using composer/drupal/sign_widget are exposed where users can create and save signatures as SVG images and those files are written to the public file system.
What does an attacker need to exploit this?
An attacker would need to supply malicious content through the signature creation process under a scenario where the resulting SVG is saved publicly. The unsafe content could then be present in the saved file and lead to cross-site scripting.