{"id":"CVE-2026-118576","kind":"vulnerability","aliases":["CVE-2026-118576"],"related":[],"title":"Drupal Stage File Proxy: cross-site scripting flaw lets attackers run scripts","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.","summary":"Stage File Proxy is a Drupal module that fetches files from a production site into a development site. Versions up to 3.1.7 and 4.0.0 through 4.0.1 fail to neutralize input, so an attacker can inject scripts that run in a visitor's browser.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","stage-file-proxy"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version with `drush pm:list --filter=stage_file_proxy` or in the Drupal admin under Extend.\n- Look for `stage_file_proxy` in the project's `composer.lock`.","fix":"- Move to a Stage File Proxy release newer than `3.1.7` on the 3.x line, or newer than `4.0.1` on the 4.x line.","status":"open","published_at":"2026-10-30T04:18:23+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:04+00:00","updated_at":"2026-10-30T04:29:04+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Stage File Proxy release newer than `3.1.7` on the 3.x line, or newer than `4.0.1` on the 4.x line.","reach":"internet","title":"Drupal Stage File Proxy: cross-site scripting flaw lets attackers run scripts","impact":"medium","summary":"Stage File Proxy is a Drupal module that fetches files from a production site into a development site. Versions up to 3.1.7 and 4.0.0 through 4.0.1 fail to neutralize input, so an attacker can inject scripts that run in a visitor's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","stage-file-proxy","php"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker scripts run in visitors' browsers on the site","analyst_note":"Check the Drupal security advisory for the exact input vector and whether the fixed versions are 3.1.8 and 4.0.2; the NVD entry gives only the version ranges.","how_to_check":"- Check the installed version with `drush pm:list --filter=stage_file_proxy` or in the Drupal admin under Extend.\n- Look for `stage_file_proxy` in the project's `composer.lock`.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal Stage File Proxy module in the affected version ranges are exposed, most often staging or development sites that pull files from production. The sources do not say which configuration makes the flaw reachable, so treat any site with the module installed as in scope. Sites that do not have the module installed can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000724,"input_tokens":4139,"output_tokens":621,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118576':16A,19A '-2026':15A,18A '0.0.0':102C '3.1.7':48B,104C '4.0.0':50B,106C '4.0.1':52B,108C 'affect':96C 'allow':88C 'attack':11A,59B 'browser':69B 'cross':6A,79C,90C 'cross-sit':5A,78C,89C 'cve':14A,17A 'develop':43B 'drupal':1A,20B,32B,84C 'fail':53B 'fetch':35B 'file':3A,25B,28B,36B,86C,98C 'flaw':9A 'generat':77C 'improp':70C 'inject':61B 'input':56B,73C 'issu':95C 'let':10A 'modul':33B 'neutral':55B,71C 'packag':21B 'page':76C 'php':22B 'product':39B 'proxi':4A,26B,29B,87C,99C 'run':12A,64B 'script':8A,13A,62B,81C,92C 'site':7A,40B,44B,80C,91C 'stage':2A,24B,27B,85C,97C 'stage-file-proxi':23B 'version':45B,100C 'visitor':67B 'vulner':82C 'web':75C 'xss':93C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Stage File Proxy module in the affected version ranges are exposed, most often staging or development sites that pull files from production. The sources do not say which configuration makes the flaw reachable, so treat any site with the module installed as in scope. Sites that do not have the module installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118576","severity":null,"published_at":"2026-10-30T04:18:23+00:00","modified_at":"2026-10-30T04:18:23+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}