PT-2026-25823 · Unknown · Parse Server

Fancymalware · Published 2026-03-16 · Updated 2026-03-20 · CVE-2026-32728

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.15 Parse Server versions prior to 8.6.41 Parse Server versions prior to 9.6.0 Parse Server versions prior to 8.6.41

Description Parse Server, an open-source backend deployable on Node.js infrastructures, is affected by a file upload issue. An attacker with file upload privileges can bypass the file extension filter by appending a MIME parameter (e.g., ;charset=utf-8) to the Content-Type header. This bypass allows the storage and serving of active content under the application's domain. Additionally, certain XML-based file extensions capable of rendering scripts in web browsers were not included in the default blocklist, potentially leading to stored cross-site scripting (XSS) attacks. Successful exploitation could compromise session tokens, user credentials, and other sensitive data accessible through the browser's local storage. The issue stems from improper validation of file extensions when a MIME parameter is present in the Content-Type header. The vulnerable component is the file upload functionality, specifically the extension validation process.

Recommendations Versions prior to 9.6.0-alpha.15 should be updated. Versions prior to 8.6.41 should be updated. Versions prior to 9.6.0 should be updated. Versions prior to 8.6.41 should be updated. Configure the fileUpload.fileExtensions option to use an allowlist of only the file extensions that your application needs, rather than relying on the default blocklist.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-PARSE-2026-32728

CVE-2026-32728

GHSA-42PH-PF9Q-CR72

Affected Products

Parse Server

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32728.json · Exploit
• https://github.com/parse-community/parse-server/commit/c7599c577a02b97eb5e76d4e20517b0283ae73c8 · Patch
• https://github.com/parse-community/parse-server/commit/4f53ab3cad5502a51a509d53f999e00ff7217b8d · Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-42ph-pf9q-cr72 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32728 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-32728 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-42ph-pf9q-cr72 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32728 · Security Note
• https://github.com/parse-community/parse-server/pull/10192 · Note
• https://github.com/parse-community/parse-server/pull/10191 · Note
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/CVEnew/status/2034520420058120341 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rvkawc/resumen_diario_de_vulnerabilidades_16032026 · Reddit Post
• https://twitter.com/RedPacketSec/status/2034735865662963899 · Twitter Post