CVE-2026-16230

Name of the Vulnerable Software and Affected Versions Formidable Digital Signatures versions prior to 3.0.7

Description Insufficient file path validation in the delete file() function allows unauthenticated attackers to delete files on the server. This occurs during the standard entry-creation POST flow on forms that accept anonymous submissions by providing a controlled filename in the item meta[field id][content] parameter and the delete saved image flag.

Recommendations Update Formidable Digital Signatures to version 3.0.7 or later.