AIKIDO-2026-917978
drupal/canvas is vulnerable to Unrestricted File Upload
45
Medium Risk
This Affects:
drupal/canvasTL;DR
The Drupal Canvas AI submodule allows image file uploads via a custom API for use in the AI web chat. These uploads are insufficiently validated before being written to Drupal's temporary directory, which in some cases can lead to cross-site scripting (XSS).
Who does this affect?
You are affected if you are using a vulnerable version of the Canvas module and have the Canvas AI submodule enabled, which exposes the image upload API used in the AI web chat.
Background info
drupal/canvas is vulnerable to Unrestricted File Upload in versions 0.0.1 - 1.4.1, 1.5.0 - 1.5.1, 1.6.0 - 1.6.0 and 1.7.0 - 1.7.0.
How to fix this
Upgrade the drupal/canvas library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.