View online: https://www.drupal.org/sa-contrib-2026-066 Project: Drupal Canvas [1] Date: 2026-July-01 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Improper validation Affected versions: <1.4.2 || >=1.5.0 <1.5.2 || >=1.6.0 <1.6.1 || >=1.7.0 <1.7.1 CVE IDs: CVE-2026-58588 Description:  The Canvas module allow you to upload image files via a custom API. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image. Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior. Solution:  Install the latest version: * If you use the 1.4.1 version of Canvas, upgrade to 1.4.2 [3] * If you use the 1.5.1 version of Canvas, upgrade to 1.5.2 [4] * If you use the 1.6.0 version of Canvas, upgrade to 1.6.1 [5] * If you use the 1.7.0 version of Canvas, upgrade to 1.7.1 [6] Reported By:  * Christian López Espínola (penyaskito) [7] Fixed By:  * AKHIL BABU (akhil babu) [8] * Christian López Espínola (penyaskito) [9] Coordinated By:  * Juraj Nemec (poker10) [10] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185250-canvas-security/-/work_items/1 [11] ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/canvas [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/canvas/releases/1.4.2 [4] https://www.drupal.org/project/canvas/releases/1.5.2 [5] https://www.drupal.org/project/canvas/releases/1.6.1 [6] https://www.drupal.org/project/canvas/releases/1.7.1 [7] https://www.drupal.org/u/penyaskito [8] https://www.drupal.org/u/akhil-babu [9] https://www.drupal.org/u/penyaskito [10] https://www.drupal.org/u/poker10 [11] https://git.drupalcode.org/security/185250-canvas-security/-/work_items/1 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....