{"id":"CVE-2026-118575","kind":"vulnerability","aliases":["CVE-2026-118575"],"related":[],"title":"Drupal Signature pad widget: stored XSS in versions up to 1.15.0","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.","summary":"The Drupal Signature pad widget module does not neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can submit data through the widget can run script in the browsers of users who view the stored content.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","signature-pad-widget"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check whether the Drupal Signature pad widget module is installed and at what version, for example with `drush pm:list --filter=signature` (unknown if the sources do not say this exact command works).\n- Look for the signature_pad widget in content types or forms on the site.","fix":"- Signature pad widget: versions from `0.0.0` to `1.15.0` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-10-30T04:18:23+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:04+00:00","updated_at":"2026-10-30T04:29:04+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:04Z","model":"claude-haiku-5-5","output":{"fix":"- Signature pad widget: versions from `0.0.0` to `1.15.0` are affected; the sources do not name a fixed version.","reach":"internet","title":"Drupal Signature pad widget: stored XSS in versions up to 1.15.0","impact":"medium","summary":"The Drupal Signature pad widget module does not neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can submit data through the widget can run script in the browsers of users who view the stored content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","signature-pad-widget","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in other users' browsers on the site","analyst_note":"Find the Drupal security advisory for the Signature pad widget and confirm the fixed version, required permissions and whether exploitation needs an account.","how_to_check":"- Check whether the Drupal Signature pad widget module is installed and at what version, for example with `drush pm:list --filter=signature` (unknown if the sources do not say this exact command works).\n- Look for the signature_pad widget in content types or forms on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that use the Signature pad widget module on forms or content types, where users can enter data that is later displayed to others. Sites without this module installed are not affected. The sources do not say whether a special permission is needed to submit the data.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000696,"input_tokens":4110,"output_tokens":570,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118575':14A,17A '-2026':13A,16A '0.0.0':98C '1.15.0':11A,100C 'affect':92C 'allow':41B,87C 'attack':48B 'browser':61B 'content':68B 'cross':44B,78C 'cross-sit':43B,77C 'cve':12A,15A 'data':52B 'drupal':1A,18B,28B,83C 'generat':38B,76C 'host':22B 'improp':69C 'input':36B,72C 'issu':91C 'modul':32B 'neutral':35B,70C 'packag':19B 'pad':3A,25B,30B,85C,94C 'page':40B,75C 'run':57B 'script':46B,58B,80C 'self':21B 'self-host':20B 'signatur':2A,24B,29B,84C,93C 'signature-pad-widget':23B 'site':45B,79C 'store':5A,42B,67B,88C 'submit':51B 'user':63B 'version':8A,96C 'view':65B 'vulner':81C 'web':39B,74C 'widget':4A,26B,31B,55B,86C,95C 'xss':6A,89C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that use the Signature pad widget module on forms or content types, where users can enter data that is later displayed to others. Sites without this module installed are not affected. The sources do not say whether a special permission is needed to submit the data.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118575","severity":null,"published_at":"2026-10-30T04:18:23+00:00","modified_at":"2026-10-30T04:18:23+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}