- Package
- drupal/sign_widget
- Fixed in
- 1.15.0
- Published
- Wed 28 Oct 2026, 17:36 LisbonUpdated Mon 2 Nov 2026, 07:26 Lisbon
In plain words
The module did not sufficiently sanitise user-supplied content before saving it to the public file system. In certain scenarios, an attacker could supply a crafted signature file containing active or unsafe content, which may cause cross-site scripting (XSS).
Am I affected?
Look for drupal/sign_widget and its version in composer.lock. The advisory lists 1.15.0 as fixed but gives no affected version range. Check whether your project uses the module to save user-supplied SVG signatures to the public file system; the description does not specify the other scenarios needed for XSS.
What to do
Check which version you have, then update to a fixed release for your branch (1.15.0):
composer show drupal/sign_widget | grep versions
composer update drupal/sign_widgetIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
This module enables users to create and save signatures as SVG images.
The module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in a cross-site scripting (XSS) vulnerability.