Vulnerability · Published Jul 11, 2026 · Assigned by VulnCheck

CVE-2026-61448Parse Server 9.0.0 Stored XSS via malformed Content-Type

Low 2.1

In plain English

A low-severity unrestricted file upload in parse-server from parse-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.1Low

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid type/subtype media type (e.g., 'image', 'image/', or 'image//svg+xml') bypasses the fileUpload.fileExtensions blocklist and is stored unchanged. On storage adapters that persist and serve the uploaded Content-Type (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed value and falls back to MIME-sniffing; a file whose body begins with HTML is rendered as HTML, executing embedded script in the application's origin against other users who open the file URL. The default GridFS storage adapter is not affected. Fixed in 9.10.0-alpha.2 and 8.6.84.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	parse-server	9.10.0-alpha.2	GHSA-r899-h629-j84r
npm	parse-server	8.6.84	GHSA-r899-h629-j84r

Affected products (as reported)

Vendor	Product	Versions
parse-community	parse-server	9.0.0 – before 9.10.0-alpha.2
parse-community	parse-server	0 – before 8.6.84

Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

References

GitHub Security Advisory (GHSA-r899-h629-j84r) vendor-advisory
VulnCheck Advisory: Parse Server 9.0.0 Stored XSS via malformed Content-Type third-party-advisory