{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-58588","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-58588\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-58588\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/2431121","id":"2431121","resource":"node"},"field_sa_advisory_id":"066","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Complex\/A:User\/CI:Some\/II:Some\/E:Theoretical\/TD:Uncommon","field_sa_description":{"value":"\u003Cp\u003EThe Canvas module allow you to upload image files via a custom API.\u003C\/p\u003E\n\u003Cp\u003EThe validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.\u003C\/p\u003E\n\u003Cp\u003ECertain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior.\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/akhil-babu\u0022 rel=\u0022nofollow\u0022\u003EAKHIL BABU (akhil babu)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/penyaskito\u0022 rel=\u0022nofollow\u0022\u003EChristian L\u00f3pez Esp\u00ednola (penyaskito)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/penyaskito\u0022 rel=\u0022nofollow\u0022\u003EChristian L\u00f3pez Esp\u00ednola (penyaskito)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use the 1.4.1 version of Canvas, upgrade to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/canvas\/releases\/1.4.2\u0022 rel=\u0022nofollow\u0022\u003E1.4.2\u003C\/a\u003E\u003C\/li\u003E\n\u003Cli\u003EIf you use the 1.5.1 version of Canvas, upgrade to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/canvas\/releases\/1.5.2\u0022 rel=\u0022nofollow\u0022\u003E1.5.2\u003C\/a\u003E\u003C\/li\u003E\n\u003Cli\u003EIf you use the 1.6.0 version of Canvas, upgrade to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/canvas\/releases\/1.6.1\u0022 rel=\u0022nofollow\u0022\u003E1.6.1\u003C\/a\u003E\u003C\/li\u003E\n\u003Cli\u003EIf you use the 1.7.0 version of Canvas, upgrade to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/canvas\/releases\/1.7.1\u0022 rel=\u0022nofollow\u0022\u003E1.7.1\u003C\/a\u003E\u003C\/li\u003E\n\u003C\/ul\u003E","format":"1"},"field_sa_type":"Improper validation","field_issue_last_status_change":"1782926469","field_sa_cve":["CVE-2026-58588"],"field_is_psa":"0","field_affected_versions":"\u003C1.4.2 || \u003E=1.5.0 \u003C1.5.2 || \u003E=1.6.0 \u003C1.6.1 || \u003E=1.7.0 \u003C1.7.1","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3607679","id":"3607679","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3607680","id":"3607680","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3607682","id":"3607682","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3607683","id":"3607683","resource":"node"}],"nid":"3607252","vid":"14414205","is_new":false,"type":"sa","title":"Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2026-066","edit_url":"https:\/\/www.drupal.org\/node\/3607252\/edit","status":"1","promote":"0","sticky":"0","created":"1782926469","changed":"1782926469","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16668242","id":16668242,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16668243","id":16668243,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16668244","id":16668244,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1782926469"}]}