View online: https://www.drupal.org/sa-contrib-2026-065 Project: Drupal Canvas [1] Date: 2026-July-01 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Improper validation Affected versions: <1.4.2 || >=1.5.0 <1.5.2 || >=1.6.0 <1.6.1 || >=1.7.0 <1.7.1 CVE IDs: CVE-2026-58587 Description: The Canvas AI submodule allows you to upload image files via a custom API to use within the AI web chat. These file uploads are insufficiently validated before being written to Drupal's temporary directory. In some cases, this may lead to cross-site scripting (XSS). Solution: Install the latest version: * If you use the 1.4.1 version of Canvas, upgrade to 1.4.2 [3] * If you use the 1.5.1 version of Canvas, upgrade to 1.5.2 [4] * If you use the 1.6.0 version of Canvas, upgrade to 1.6.1 [5] * If you use the 1.7.0 version of Canvas, upgrade to 1.7.1 [6] Reported By: * AKHIL BABU (akhil babu) [7] Fixed By: * Alex Bronstein (effulgentsia) [8] of the Drupal Security Team * Christian López Espínola (penyaskito) [9] Coordinated By: * Juraj Nemec (poker10) [10] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3591755-canvas-security/-/work_items/1 [11] ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/canvas [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/canvas/releases/1.4.2 [4] https://www.drupal.org/project/canvas/releases/1.5.2 [5] https://www.drupal.org/project/canvas/releases/1.6.1 [6] https://www.drupal.org/project/canvas/releases/1.7.1 [7] https://www.drupal.org/u/akhil-babu [8] https://www.drupal.org/u/effulgentsia [9] https://www.drupal.org/u/penyaskito [10] https://www.drupal.org/u/poker10 [11] https://git.drupalcode.org/security/3591755-canvas-security/-/work_items/1 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....