PT-2026-23872 · Unknown · Parse Server

Fancymalware · Published 2026-03-07 · Updated 2026-03-11 · CVE-2026-30848

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.8 Parse Server versions prior to 9.5.0-alpha.8

Description Parse Server, an open source backend deployable on Node.js infrastructures, contains a path traversal flaw in the PagesRouter static file serving route. This allows unauthenticated access to files outside the designated pagesPath directory. The issue stems from a string prefix comparison lacking directory separator enforcement, enabling attackers to access files in sibling directories with names sharing a prefix with the pages directory. The vulnerable route is susceptible to path traversal sequences.

Recommendations Update to Parse Server version 8.6.8 or later. Update to Parse Server version 9.5.0-alpha.8 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-PARSE-2026-30848

CVE-2026-30848

GHSA-HM3F-Q6RW-M6WH

Affected Products

Parse Server

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30848.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-hm3f-q6rw-m6wh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hm3f-q6rw-m6wh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30848 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30848 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-30848 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/VulmonFeeds/status/2030408950038851896 · Twitter Post
• https://twitter.com/CVEnew/status/2030339282901356701 · Twitter Post
• https://twitter.com/dailycve/status/2031117061749866891 · Twitter Post
• https://t.me/CVEtracker/46739 · Telegram Post