CVE-2026-58588: Drupal Canvas Module Image Upload Vulnerability
Summary
CVE-2026-58588: The Canvas module allow you to upload image files via a custom API. Affects drupal/canvas across 4 version ranges.
< 1.4.2
>= 1.5.0, < 1.5.2
>= 1.6.0, < 1.6.1
>= 1.7.0, < 1.7.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Canvas module for Drupal allows users to upload image files through a custom API. It is designed to facilitate image handling within Drupal applications, providing features for image manipulation and display. However, the module has a critical vulnerability that arises from inadequate file validation, specifically concerning MIME type checks.
Vulnerability Detail
The vulnerability stems from the Canvas module's failure to validate the MIME type of uploaded files, relying solely on file extension checks. This oversight permits malicious users to upload non-image files disguised as images. If the web server is configured to serve files with their actual MIME type, this could lead to cross-site scripting (XSS) attacks or other unexpected behaviors, compromising the security of the application and its users.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.4.21.4.2 -
>= 1.5.0, < 1.5.21.5.2 -
>= 1.6.0, < 1.6.11.6.1 -
>= 1.7.0, < 1.7.11.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement server-side restrictions to ensure that only files with valid image MIME types are processed. This can be done by configuring your web server to check MIME types before serving uploaded files.
Conclusion
The vulnerability identified as CVE-2026-58588 in the Drupal Canvas module poses significant security risks due to inadequate file validation. It is crucial for users of this module to update to the latest patched versions to safeguard their applications against potential attacks.
See every vulnerability recorded for drupal/canvas →
FAQ
CVE-2026-58588 is a vulnerability in the Drupal Canvas module that allows for the upload of non-image files due to insufficient MIME type validation.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your manifest file.
The risks include potential cross-site scripting (XSS) attacks and other unexpected behaviors that could compromise user data and application integrity.
You can update the Canvas module using Composer with the command: composer require drupal/canvas:^1.4.2 to ensure you are using a secure version.
Yes, you can implement server-side restrictions to validate the MIME types of uploaded files as a temporary workaround until the module is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/canvas.
