SA-CONTRIB-2026-286: Critical severity composer/drupal/stage_file_proxy vulnerability
Stage File Proxy is a general solution for getting production files on a development server on demand. It is not intended for usage on production sites. The module doesn't sufficiently check file URL for malicious content when attempting to do fallback retrieval leading to a cross-site scripting vulnerability. This vulnerability is mitigated by the fact this development module must be enabled on an attacker's target site, and the attacker must be able to upload a malicious file to the "origin" server configured for the module.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/stage_file_proxyto a version that resolves this vulnerability.Fixed in 4.0.1Fixed in 3.1.7 - Compensating control
Do not use or enable the Stage File Proxy development module on production sites.
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Sites with the Stage File Proxy development module enabled are exposed. The module is not intended for production use.
What does an attacker need to exploit this issue?
An attacker must be able to upload a malicious file to the origin server configured for the module. The vulnerable module must also be enabled on the target site.
What can be done if the module cannot be removed immediately?
Disable Stage File Proxy where possible, especially on production sites, and prevent untrusted users from uploading files to the configured origin server.