CVE-2026-118576 — Stage File Proxy — Critical — Cross-Site Scripting (XSS) — SA-CONTRIB-2026-286

A vulnerability in Drupal Stage File Proxy allows cross-site scripting (XSS). Affected versions are 0.0.0–3.1.7 and 4.0.0–4.0.1.