Drupal Canvas contains a server‑side request forgery vulnerability that allows an attacker to instruct the server to make requests to arbitrary URLs. This flaw enables probing of internal network services or accessing resources the server can reach, potentially revealing sensitive data or aiding further attacks. The weakness is classified as CWE‑918.

The issue affects all Drupal Canvas installations with a version number less than 1.1.1, including the initial release 0.0.0. The affected component is the Drupal Canvas module, identified by the CPE string cpe:2.3:a:drupal_canvas_project:drupal_canvas:*:*:*:*:*:drupal:*:*. The vendor responsible for this product is Drupal.

The CVSS v3.1 score assigned to this vulnerability is 5.0, indicating a moderate risk. The EPSS score is below 1 %, suggesting a low prevalence of exploit activity in the wild. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, meaning no widely known exploits are documented. Nevertheless, because the flaw permits arbitrary outbound requests, an attacker who can reach the affected server can exfiltrate information or pivot to other internal assets. The exploit requires network connectivity to the target server and can be performed without local privileges, making it potentially feasible for remote attackers.