Drupal Canvas EUVD-2026-15476

While a CVSS score and EPSS exploitation probability are not provided, the vulnerability's classification as SSRF (CWE-918) and its inclusion in the ENISA EUVD database (EUVD-2026-15476) indicate moderate-to-high real-world risk. SSRF vulnerabilities typically require low attack complexity and no authentication, making them highly exploitable once a public proof-of-concept or detailed technical analysis becomes available. The lack of a CVSS vector prevents full CVSS-based assessment, but SSRF vulnerabilities commonly achieve high impact by enabling lateral movement, credential theft, or data exfiltration. The availability of a vendor patch (version 1.1.1) suggests the vulnerability was confirmed and reproducible; however, without KEV (Known Exploited Vulnerability) status confirmation or public POC data in the provided intelligence, exploitation likelihood in the wild remains uncertain. Organizations running unpatched Drupal Canvas should prioritize patching based on network exposure and the presence of sensitive internal services accessible from the affected server.

An unauthenticated attacker could exploit this vulnerability by submitting a specially crafted request to a Drupal Canvas endpoint that accepts URL parameters (such as an image URL, remote content URL, or API endpoint field). The attacker supplies a malicious URL pointing to an internal service, such as http://169.254.169.254/latest/meta-data/ (AWS metadata), http://localhost:8080/admin, or a restricted internal API. The Drupal Canvas server, without proper validation, fetches the URL on behalf of the attacker, exposing sensitive information (credentials, configuration, internal IP addresses) or allowing the attacker to trigger actions on internal systems. This could lead to privilege escalation, lateral movement within the network, or unauthorized access to cloud provider metadata and credentials.