CVE-2026-122080

The htmLawed module enables use of the [htmLawed](https://bioinformatics.org/phplabware/internal utilities/htmLawed/index.php) PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.

The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability.

Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17.