PT-2026-57441 · Unknown · Parse Server

Cyberkareem + 1 · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-61448

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Low

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.0-alpha.1 Parse Server versions 8.x and earlier through 8.6.83

Description A stored cross-site scripting (XSS) issue exists when the mime package does not recognize an uploaded file's extension, causing Parse Server to preserve the client-supplied Content-Type. A malformed Content-Type that is not a valid type/subtype media type can bypass the fileUpload.fileExtensions blocklist and be stored unchanged. On storage adapters that persist and serve the uploaded Content-Type, such as Amazon S3, Google Cloud Storage, or Azure Blob Storage, browsers may perform MIME-sniffing—a process where the browser attempts to determine the file type by inspecting its content—and render files starting with HTML as HTML. This allows the execution of embedded scripts in the application's origin against users who open the file URL.

Recommendations Update to version 9.10.0-alpha.2 or later. Update to version 8.6.84 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-61448

Affected Products

Parse Server

References · 5

• https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-61448 · Security Note
• https://vulncheck.com/advisories/parse-server-stored-xss-via-malformed-content-type · Note
• https://twitter.com/infoflowcloud/status/2075977371182624959 · Twitter Post
• https://twitter.com/CVEnew/status/2075976708000264588 · Twitter Post