PT-2026-24758 · Bitnami+4 · Parse+1

Restriction · Published 2026-03-11 · Updated 2026-03-13 · CVE-2026-31868

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.4 Parse Server versions prior to 8.6.30

Description Parse Server allows an attacker to upload files with extensions or content types not blocked by the default configuration of the fileUpload.fileExtensions option. These files, potentially containing malicious code like JavaScript within SVG or XHTML files, can be executed when accessed through a URL, leading to a stored Cross-Site Scripting (XSS) issue. This can enable an attacker to steal session tokens, redirect users, or perform actions on behalf of other users. Affected file extensions and content types include .svgz, .xht, .xml, .xsl, .xslt, and content types application/xhtml+xml and application/xslt+xml for extensionless uploads. The vulnerability involves the fileUpload.fileExtensions option.

Recommendations For versions prior to 9.6.0-alpha.4, update to version 9.6.0-alpha.4 or later. For versions prior to 8.6.30, update to version 8.6.30 or later. Configure the fileUpload.fileExtensions server option to block the affected file extensions and content types.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-PARSE-2026-31868

CVE-2026-31868

GHSA-V5HF-F4C3-M5RV

Affected Products

Parse

Parse Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31868.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-v5hf-f4c3-m5rv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v5hf-f4c3-m5rv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31868 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31868 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-31868 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.4 · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.30 · Note
• https://twitter.com/CVEnew/status/2031992396016468014 · Twitter Post