[IT-SecNots] [Security-news] Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-066

Project: Drupal Canvas [1]
Date: 2026-July-01
Security risk: *Moderately critical* 11 ∕ 25
AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2]
Vulnerability: Improper validation

Affected versions: <1.4.2 || >=1.5.0 <1.5.2 || >=1.6.0 <1.6.1 || >=1.7.0
<1.7.1
CVE IDs: CVE-2026-58588
Description: 
The Canvas module allow you to upload image files via a custom API.

The validation rules check the file extension of the uploaded file but not
the file MIME type. This may allow a malicious user to upload a file that is
not an image.

Certain web-server configurations may serve the uploaded file with its actual
MIME type rather than an image type. This may lead to cross-site scripting
(XSS) or other unexpected behavior.

Solution: 
Install the latest version:

 * If you use the 1.4.1 version of Canvas, upgrade to 1.4.2 [3]
 * If you use the 1.5.1 version of Canvas, upgrade to 1.5.2 [4]
 * If you use the 1.6.0 version of Canvas, upgrade to 1.6.1 [5]
 * If you use the 1.7.0 version of Canvas, upgrade to 1.7.1 [6]

Reported By: 
 * Christian López Espínola (penyaskito) [7]

Fixed By: 
 * AKHIL BABU (akhil babu) [8]
 * Christian López Espínola (penyaskito) [9]

Coordinated By: 
 * Juraj Nemec (poker10) [10] of the Drupal Security Team

Security
issue: 
https://git.drupalcode.org/security/185250-canvas-security/-/work_items/1
[11]
------------------------------------------------------------------------------
Contribution record [12]

[1] https://www.drupal.org/project/canvas
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/canvas/releases/1.4.2
[4] https://www.drupal.org/project/canvas/releases/1.5.2
[5] https://www.drupal.org/project/canvas/releases/1.6.1
[6] https://www.drupal.org/project/canvas/releases/1.7.1
[7] https://www.drupal.org/u/penyaskito
[8] https://www.drupal.org/u/akhil-babu
[9] https://www.drupal.org/u/penyaskito
[10] https://www.drupal.org/u/poker10
[11]  
https://git.drupalcode.org/security/185250-canvas-security/-/work_items/1
[12]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3607252

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at