CVE-2021-36539

MEDIUM 6.5CVE-2021-36539 · Published 26/01/2023 · updated 17/06/2026

In short

CVE-2021-36539 is a MEDIUM (CVSS 6.5) vulnerability affecting canvas learning management service (instructure).
Chance of exploitation in the next 30 days (EPSS): 0.90%, higher than 60.0% of all vulnerabilities.
Fix: update to 2022-10-15 or later.

Package	Affected versions	Patched versions
canvas learning management service instructure	`< 2022-10-15`	`2022-10-15`

Description

Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).

References

gaukas/instructure-canvas-file-oracle · Exploit
instructure/canvas-lms · Exploit

More vulnerabilities in canvas learning management service

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free