Most recent entries from all

DRUPAL-CONTRIB-2026-286

2026-10-31T09:54:15.084414+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/stage_file_proxy

Stage File Proxy is a general solution for getting production files on a development server on demand. **It is not intended for usage on production sites.**

The module doesn't sufficiently check file URL for malicious content when attempting to do fallback retrieval leading to a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact this development module must be enabled on an attacker's target site, and the attacker must be able to upload a malicious file to the "origin" server configured for the module.

fkie_cve-2026-118576

2026-10-31T09:54:15.084531+00:00

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.

GHSA-qrww-563x-vvf9

2026-10-31T09:54:15.084588+00:00

WID-SEC-W-2026-4230 — Drupal Erweiterungen: Mehrere Schwachstellen

2026-10-31T09:54:15.084616+00:00

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.