Live › vulnerability › CVE-2026-118576
Stage File Proxy is a Drupal module that fetches files from a production site into a development site. Versions up to 3.1.7 and 4.0.0 through 4.0.1 fail to neutralize input, so an attacker can inject scripts that run in a visitor's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal Stage File Proxy module in the affected version ranges are exposed, most often staging or development sites that pull files from production. The sources do not say which configuration makes the flaw reachable, so treat any site with the module installed as in scope. Sites that do not have the module installed can skip it.
No product ranges from the sources yet.
drush pm:list --filter=stage_file_proxy or in the Drupal admin under Extend.stage_file_proxy in the project's composer.lock.3.1.7 on the 3.x line, or newer than 4.0.1 on the 4.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-118576")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.