# CVE-2026-58588: Drupal Canvas cross-site scripting via improper file validation

Source: https://junglewise.ai/threats/cve-2026-58588-drupal-canvas-cross-site-scripting-via-improper-file-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-58588 · Severity: info · CVSS 4.3 · Published 2026-07-10

Drupal Canvas is a module that allows website builders to design pages and manage content directly in the browser. A security flaw in the module's file upload system allows users to upload malicious files that bypass intended image restrictions. If a visitor accesses these files, an attacker could execute malicious scripts in the visitor's browser, potentially leading to unauthorized actions or data theft.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas](https://junglewise.ai/threats/technologies/packagist-https-packages-drupal-org-8-drupal-canvas). Vendors: [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-58588 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58588 being exploited in the wild.

**How severe is CVE-2026-58588?** Informational severity, with a CVSS score of 4.3, published 10 July 2026.

**Which products and versions are affected?** Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas ECOSYSTEM:introduced=0,fixed=1.4.2|ECOSYSTEM:introduced=1.5.0,fixed=1.5.2|ECOSYSTEM:introduced=1.6.0,fixed=1.6.1|ECOSYSTEM:introduced=1.7.0,fixed=1.7.1.

**Is there a fix for CVE-2026-58588?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas: upgrade to 1.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58588 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-58588?** Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Canvas: upgrade to 1.4.2 or later

## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal Canvas module due to improper neutralization of input during file uploads. The module's custom API validates file extensions but fails to verify the actual MIME type of uploaded files. An attacker can exploit this by uploading a non-image file (such as an HTML file with embedded JavaScript) disguised with an image extension. Depending on the web server configuration, the file may be served with its original MIME type, allowing the execution of arbitrary scripts in the context of the user's session. This affects versions prior to 1.4.2, 1.5.2, 1.6.1, and 1.7.1.

## Affected products

- Drupal Drupal Canvas 0.0.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, 1.7.0 to 1.7.1

## Identifiers

- CVE-2026-58588
- DRUPAL-CONTRIB-2026-066

## Timeline

- 2026-07-01: patched: Security release versions 1.4.2, 1.5.2, 1.6.1, and 1.7.1 published.
- 2026-07-10: disclosed: CVE-2026-58588 published.

## References

- [https://www.drupal.org/project/canvas](https://www.drupal.org/project/canvas)
- [https://www.drupal.org/sa-contrib-2026-066](https://www.drupal.org/sa-contrib-2026-066)

## Related threats

- [Drupal Canvas cross-site scripting in Canvas AI submodule](https://junglewise.ai/threats/cve-2026-58587-drupal-canvas-cross-site-scripting-in-canvas-ai-submodule)
- [DRUPAL-CONTRIB-2026-017 - This module enables you to easily theme and build an entire website using only their…](https://junglewise.ai/threats/cve-2026-3216-drupal-contrib-2026-017-this-module-enables-you-to-easily-theme)
- [DRUPAL-CONTRIB-2026-006 - This Drupal Canvas module is a new visual page builder for Drupal. You can create reusable…](https://junglewise.ai/threats/cve-2026-1553-drupal-contrib-2026-006-this-drupal-canvas-module-is-a-new-visual)