From the Canvas team:

In early April, Apple released Safari updates that included a major update to a feature called Intelligent Tracking Protection (ITP). This feature implements new limitations to resources like files that are loaded on pages from a third-party site, and it behaves differently than similar systems implemented in other browsers like Chrome and Firefox.

This update affected the mechanism that Canvas uses to securely host and transmit uploaded files, including images. Users may experience files that fail to download, or images that fail to display. This behavior is due to redirection in the authentication implementation of Canvas’ secure file system, which Safari detects as a “third-party” site because it resides on a different domain.

Our engineering teams are actively investigating solutions to this issue, but a timeline is not yet available.

In the meantime, there are two workarounds: