CVE-2026-55778

EUVD-2026-42414

08.07.2026, 21:16

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.11 and 8.6.81, the default fileUpload.fileExtensions blocklist could be bypassed by uploading a file with a non-standard or compound extension and dangerous content type, allowing storage adapters such as S3 and GCS to serve attacker-supplied active content and enable stored cross-site scripting. This issue is fixed in versions 9.9.1-alpha.11 and 8.6.81.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	UNKNOWN				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-434 - Unrestricted Upload of File with Dangerous Type
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

References

https://github.com/parse-community/parse-server/commit/97c6a78d19f976ec756c1295f08a8fccab90799a

https://github.com/parse-community/parse-server/commit/be12a60d65b6e140481882037fb896b1f951df50

https://github.com/parse-community/parse-server/pull/10505

https://github.com/parse-community/parse-server/pull/10506

https://github.com/parse-community/parse-server/releases/tag/8.6.81

https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.11

https://github.com/parse-community/parse-server/security/advisories/GHSA-v8x7-r927-cc93