EUVD-2026-15476
GHSA-6qhv-qccp-876q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.
AnalysisAI
A Server-Side Request Forgery (SSRF) vulnerability exists in Drupal Canvas versions prior to 1.1.1, allowing attackers to manipulate the server into making unauthorized requests to internal or external resources. This vulnerability affects all Drupal Canvas installations from version 0.0.0 through 1.1.0, enabling attackers to access sensitive internal services, bypass network segmentation, or exfiltrate data. No CVSS score, EPSS data, or public proof-of-concept information is currently available, though the vulnerability has been formally documented by the Drupal security team.
Technical ContextAI
Server-Side Request Forgery (SSRF) vulnerabilities, classified under CWE-918, occur when a web application fetches remote resources without properly validating or sanitizing user-supplied URLs. In the context of Drupal Canvas (cpe:2.3:a:drupal:drupal_canvas:*:*:*:*:*:*:*:*), the vulnerability likely stems from insufficient input validation on URL or endpoint parameters used during server-side HTTP requests, potentially involving image processing, remote content fetching, or API integration features. The Drupal Canvas module, which provides canvas rendering or similar functionality, fails to enforce allowlists or properly sandbox HTTP requests, allowing attackers to craft malicious URLs that force the server to connect to unintended targets such as internal metadata services (e.g., AWS IMDSv1), local file systems via file:// URIs, or restricted internal APIs.
RemediationAI
Upgrade Drupal Canvas to version 1.1.1 or later immediately, following the patch guidance provided in the Drupal security advisory (https://www.drupal.org/sa-contrib-2026-017). If immediate patching is not possible, implement network-level controls by restricting outbound HTTP/HTTPS connections from the web server to only approved internal and external endpoints, using firewall rules or proxy policies to block access to metadata services (e.g., 169.254.169.254 for cloud environments). Additionally, disable or restrict the specific Drupal Canvas features that perform remote content fetching until patching is completed, and monitor server logs for suspicious HTTP requests originating from the Drupal Canvas module. Consider implementing a Web Application Firewall (WAF) rule to detect and block SSRF-like patterns in user input.
More in Drupal Canvas
View allCross-site scripting in the Drupal Canvas contributed module enables remote attackers to inject and execute malicious sc
Cross-site scripting in the Drupal Canvas contributed module allows unauthenticated remote attackers to inject and execu
Improper authorization controls in Drupal Canvas versions before 1.0.4 enable attackers to bypass access restrictions an
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today