ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-61448

Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

Published Oct 29, 2026 · catalog updated Oct 29, 2026 · Parse Server vulnerable to

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-61448. EPSS is 0.41%. Act only if a listed version of Parse Server vulnerable to is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Parse Server vulnerable to).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Low—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.41%
Remediation
Version ranges on file
Affected products
npm parse-server

### Impact Parse Server's file upload validation uses the option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the package, Parse Server preserves the client-supplied and passes it to the storage adapter. A malformed that is not a valid media type — for example (no subtype), (empty subtype), or (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the from the filename and serves files with . ### Patches The file upload handler now validates that the client-supplied is a well-formed media type ( with non-empty tokens per RFC 9110 §5.6.2) whenever the filename extension is not recognized by . Malformed values are rejected instead of being stored, while well-formed types — including custom or vendor types that the package does not recognize — continue to be accepted; only blocklisted subtypes are rejected. ### Workarounds Configure as a strict allowlist of only the extensions the application needs (for example ). Additionally, serve uploaded files from a domain separate from the application so that any rendered content is isolated from the application's origin, and configure the storage/CDN layer to send . ### References - GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r - Fix Parse Server 9: https://github.com/parse-

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm parse-server<= 8.6.83
  • npm parse-server>= 9.0.0, < 9.10.0-alpha.2

How to fix CVE-2026-61448

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-61448. EPSS is 0.41%. Act only if a listed version of Parse Server vulnerable to is installed.

Which versions are affected?

Compare what you have installed with <= 8.6.83, >= 9.0.0, < 9.10.0-alpha.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-434: Unrestricted Upload of File with Dangerous Type. EPSS 0.41%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 29, 2026 · GitHub Advisory Database

    Detected

    ### Impact Parse Server's file upload validation uses the option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the package, Parse Server preserves the client-supplied and passes it to the storage adapter. A malformed that is not a valid media type

  2. Oct 29, 2026 · GitHub Advisory Database

    Updated

    ### Impact Parse Server's file upload validation uses the option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the package, Parse Server preserves the client-supplied and passes it to the storage adapter. A malformed that is not a valid media type

Sources

  • CVE.orgVulnerability recordCVE-2026-61448

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-r899-h629-j84r

    Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-61448

    Parse Server's file upload validation uses the fileUpload.fileExtensions option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type and passes it to the storage adapter. A malform

    advisories.gitlab.com

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitLab Advisory DatabaseNov 3, 2026
  • CVE.orgOct 30, 2026
  • GitHub Advisory DatabaseOct 30, 2026