DRUPAL-CONTRIB-2026-286: Composer/drupal/stage_file_proxy vulnerability

Q: Who is realistically exposed to this vulnerability?

Sites with the Stage File Proxy development module enabled are exposed, particularly if they use it to retrieve files from an origin server. The module is explicitly not intended for production use.

Q: What does an attacker need to exploit it?

The attacker must be able to upload a malicious file to the origin server configured for Stage File Proxy. They also need the vulnerable module to be enabled on the target site.

Q: What can be done if the module cannot be patched immediately?

Disable Stage File Proxy where it is not needed, especially on production sites. Restrict who can upload files to the configured origin server and prevent untrusted content from being available through that origin.

Published Oct 28, 2026

Updated

Stage File Proxy is a general solution for getting production files on a development server on demand. It is not intended for usage on production sites.

The module doesn't sufficiently check file URL for malicious content when attempting to do fallback retrieval leading to a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact this development module must be enabled on an attacker's target site, and the attacker must be able to upload a malicious file to the "origin" server configured for the module.

Affected Software

2 affected componentsFixes available

composer/drupal/stage_file_proxy<3.1.7

3.1.7

composer/drupal/stage_file_proxy>=4.0.0<4.0.1

4.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/stage_file_proxy to a version that resolves this vulnerability.
Fixed in 3.1.7
Upgrade
Upgrade composer/drupal/stage_file_proxy to a version that resolves this vulnerability.
Fixed in 4.0.1

Event History

Oct 28, 2026

Advisory Published

via OSV·05:36 PM

Data Sourced

via OSV·05:36 PM

DescriptionAffected Software

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

Sites with the Stage File Proxy development module enabled are exposed, particularly if they use it to retrieve files from an origin server. The module is explicitly not intended for production use.

What does an attacker need to exploit it?

The attacker must be able to upload a malicious file to the origin server configured for Stage File Proxy. They also need the vulnerable module to be enabled on the target site.

What can be done if the module cannot be patched immediately?

Disable Stage File Proxy where it is not needed, especially on production sites. Restrict who can upload files to the configured origin server and prevent untrusted content from being available through that origin.

DRUPAL-CONTRIB-2026-286: Composer/drupal/stage_file_proxy vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

What does an attacker need to exploit it?

What can be done if the module cannot be patched immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

What does an attacker need to exploit it?

What can be done if the module cannot be patched immediately?