- Package
- drupal/stage_file_proxy
- Fixed in
- 3.1.7, 4.0.1
- Published
- Wed 28 Oct 2026, 17:36 LisbonUpdated Mon 2 Nov 2026, 07:26 Lisbon
In plain words
Stage File Proxy does not sufficiently check file URLs for malicious content during fallback retrieval, which can allow cross-site scripting. The module must be enabled on the target site, and the attacker must be able to upload a malicious file to the module's configured origin server.
Am I affected?
Look for drupal/stage_file_proxy and its version in composer.lock. The advisory lists fixes in 3.1.7 and 4.0.1, but gives no affected version ranges. Check whether the module is enabled, whether fallback retrieval is used, and whether an attacker could upload files to its configured origin server.
What to do
Check which version you have, then update to a fixed release for your branch (3.1.7, 4.0.1):
composer show drupal/stage_file_proxy | grep versions
composer update drupal/stage_file_proxyIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The advisory says the risk is mitigated by requiring the module to be enabled and the attacker to have upload access to the configured origin server. It also states that this development module is not intended for production sites.
The advisory's description
Stage File Proxy is a general solution for getting production files on a development server on demand. It is not intended for usage on production sites.
The module doesn't sufficiently check file URL for malicious content when attempting to do fallback retrieval leading to a cross-site scripting vulnerability.
This vulnerability is mitigated by the fact this development module must be enabled on an attacker's target site, and the attacker must be able to upload a malicious file to the "origin" server configured for the module.