# HedgeDoc 1.10.3 — HedgeDoc 1.10.3

- Product: HedgeDoc (https://whatsnew.fyi/product/hedgedoc)
- Vendor: HedgeDoc
- Date: 2025-04-09
- Version: 1.10.3
- Original notes: https://github.com/hedgedoc/hedgedoc/releases/tag/1.10.3
- Permalink: https://whatsnew.fyi/product/hedgedoc/releases/1.10.3

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix a possible XSS exploit that could be planted via a malicious SVG file upload
- **added** — Add config options CMD_SAML_WANT_ASSERTIONS_SIGNED and CMD_SAML_WANT_AUTHN_RESPONSE_SIGNED for SAML auth to accommodate instances not complying with new defaults

###### Security fixes

This release fixes a security issue of a possible XSS exploit which can be planted via a malicous SVG file upload.

See [CVE-2025-32391](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-3983-rrqh-mvx5) for more details

###### Enhancements

- Add config options `CMD_SAML_WANT_ASSERTIONS_SIGNED` and `CMD_SAML_WANT_AUTHN_RESPONSE_SIGNED` for SAML auth, since
  some instances didn't comply with the new defaults of `@node-saml/passport-saml`