Drupal Canvas EUVD-2026-43070

Exploitation requires that the target Drupal site has the Canvas contributed module installed and enabled at a vulnerable version (0.0.0-<1.4.2, 1.5.0-<1.5.2, 1.6.0-<1.6.1, or 1.7.0-<1.7.1). The CVSS UI:R metric confirms a victim user must actively interact with a crafted link or page - passive browsing alone is insufficient, limiting fully automated exploitation. PR:N confirms the attacker requires no server-side authentication to deliver the payload. Exploitation is further limited to Drupal deployments that have explicitly installed this non-core contributed module; the vast majority of Drupal sites without Canvas installed are unaffected regardless of Drupal core version.

The CVSS 6.1 (Medium) score is consistent with a reflected or stored XSS that requires user interaction (UI:R), which prevents automated, mass exploitation. The scope change (S:C) elevates the score above a typical contained XSS by acknowledging cross-context script execution in the victim's browser. However, several signals indicate limited real-world urgency: EPSS at 0.20% places this in the 10th percentile - extremely low exploitation probability among known vulnerabilities - and there is no CISA KEV listing and no identified POC. The PR:N metric confirms attackers require no authentication on the server side to deliver the payload, but the UI:R constraint means each exploitation attempt requires social engineering a specific victim. The niche deployment footprint of the Canvas contributed module further reduces aggregate exposure. This is a genuine medium-priority issue for affected sites, but not an emergency requiring out-of-band response.

An attacker identifies a Drupal site running a vulnerable version of Drupal Canvas and crafts a URL containing an unsanitized script payload targeting a Canvas-rendered parameter. The attacker distributes this link via phishing email or a compromised third-party site targeting Drupal editors or administrators; when the victim clicks the link and the page loads, the injected script executes in their browser session, potentially exfiltrating session cookies or performing actions on the Drupal admin interface on the attacker's behalf.