CVE-2020-5775: Instructure Canvas Learning Management Service

Medium severity, CVSS 5.8. EPSS: 6.5% chance of exploitation in the next 30 days.

Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTTP GET requests to arbitrary domains.

Affected products

• Instructure Canvas Learning Management Service: version 2020-07-29 only

Published 2020-08-21. Last modified 2026-06-17.