En bref
- CVE-2026-118575 est une vulnérabilité MOYENNE (CVSS 6.1) touchant drupal/sign_widget.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.16%, plus élevée que 5.0% des vulnérabilités.
- Correctif : mettre à jour vers 1.15.0 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| drupal/sign_widget Packagist:https://packages.drupal.org/8 | < 1.15.0
| 1.15.0
|
Description
This module enables users to create and save signatures as SVG images.
The module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in a cross-site scripting (XSS) vulnerability.
NVD description
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free