View online: https://www.drupal.org/sa-contrib-2026-286 Project: Stage File Proxy [1] Project machine name: stage_file_proxy Date: 2026-October-28 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <3.1.7 || >=4.0.0 <4.0.1 CVE IDs: CVE-2026-118576 Description: Stage File Proxy is a general solution for getting production files on a development server on demand. *It is not intended for usage on production sites.* The module doesn't sufficiently check file URL for malicious content when attempting to do fallback retrieval leading to a cross-site scripting vulnerability. This vulnerability is mitigated by the fact this development module must be enabled on an attacker's target site, and the attacker must be able to upload a malicious file to the "origin" server configured for the module. Solution: Install the latest version: * If you use the stage_file_proxy module, upgrade to Stage File Proxy 4.0.1 [3] or Stage File Proxy 3.1.7 [4] Reported By: * Marcus Johansson (marcus_johansson) [5] Fixed By: * Marcus Johansson (marcus_johansson) [6] * Stephen Mustgrave (smustgrave) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/stage_file_proxy [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/stage_file_proxy/releases/4.0.1 [4] https://www.drupal.org/project/stage_file_proxy/releases/3.1.7 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/marcus_johansson [7] https://www.drupal.org/u/smustgrave [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....