"It has been a pleasure to work with Casey, Rick and Phil from Ricochet. We were initially faced with a dip in productivity on our project due to some team member's contributing to DrupalCon Munich. Casey and team were able to step in, ramp up, and start contributing to solutions immediately. When our team members returned from Munich, we decided the Ricochet guys were too valuable and helpful to let go, so we have kept them on as members of the team until launch.
—Suzy Bates, Four Kitchens

Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066

Wed, 2026-07-01 10:21 — Anonymous (not verified)

Project: Drupal CanvasDate: 2026-July-01Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Improper validationAffected versions: <1.4.2 || >=1.5.0 <1.5.2 || >=1.6.0 <1.6.1 || >=1.7.0 <1.7.1CVE IDs: CVE-2026-58588Description: The Canvas module allow you to upload image files via a custom API.
The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.
Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior.Solution: Install the latest version:

If you use the 1.4.1 version of Canvas, upgrade to 1.4.2
If you use the 1.5.1 version of Canvas, upgrade to 1.5.2
If you use the 1.6.0 version of Canvas, upgrade to 1.6.1
If you use the 1.7.0 version of Canvas, upgrade to 1.7.1

Reported By:

Christian López Espínola (penyaskito)

Fixed By:

Coordinated By:

Juraj Nemec (poker10) of the Drupal Security Team

Path to article https://www.drupal.org/sa-contrib-2026-066

Search form

Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066