Stage File Proxy is a Drupal module designed to fetch production files on development servers. It is not intended for use on production sites. A vulnerability exists due to insufficient validation of file URLs during fallback retrieval, leading to a cross-site scripting (XSS) vulnerability. Exploitation requires the module to be enabled on the target site and the attacker to have the ability to upload a malicious file to the configured origin server. Fixed versions 3.1.7 and 4.0.1 address this issue.