CVE-2026-58588: Drupal Canvas cross-site scripting via improper file validation

CVE-2026-58588 · Severity: info · CVSS 4.3 · Published 2026-07-10

Drupal Canvas is a module that allows website builders to design pages and manage content directly in the browser. A security flaw in the module's file upload system allows users to upload malicious files that bypass intended image restrictions. If a visitor accesses these files, an attacker could execute malicious scripts in the visitor's browser, potentially leading to unauthorized actions or data theft.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas. Vendors: Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-58588 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58588 being exploited in the wild.
How severe is CVE-2026-58588?
Informational severity, with a CVSS score of 4.3, published 10 July 2026.
Which products and versions are affected?
Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas ECOSYSTEM:introduced=0,fixed=1.4.2|ECOSYSTEM:introduced=1.5.0,fixed=1.5.2|ECOSYSTEM:introduced=1.6.0,fixed=1.6.1|ECOSYSTEM:introduced=1.7.0,fixed=1.7.1.
Is there a fix for CVE-2026-58588?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas: upgrade to 1.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58588 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-58588?
Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas: upgrade to 1.4.2 or later

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal Canvas module due to improper neutralization of input during file uploads. The module's custom API validates file extensions but fails to verify the actual MIME type of uploaded files. An attacker can exploit this by uploading a non-image file (such as an HTML file with embedded JavaScript) disguised with an image extension. Depending on the web server configuration, the file may be served with its original MIME type, allowing the execution of arbitrary scripts in the context of the user's session. This affects versions prior to 1.4.2, 1.5.2, 1.6.1, and 1.7.1.

Affected products

  • Drupal Drupal Canvas 0.0.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, 1.7.0 to 1.7.1

Identifiers

  • CVE-2026-58588
  • DRUPAL-CONTRIB-2026-066

Timeline

  • 2026-07-01: patched: Security release versions 1.4.2, 1.5.2, 1.6.1, and 1.7.1 published.
  • 2026-07-10: disclosed: CVE-2026-58588 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.