CVE-2026-61448 json
Parse Server 9.0.0 Stored XSS via malformed Content-Type
published 2026-07-11 3 mo ago modified 2026-10-29 10 d ago also BIT-parse-2026-61448 , EUVD-2026-43183 , GHSA-r899-h629-j84r
- cvss
- 2.1
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid type/subtype media type (e.g., 'image', 'image/', or 'image//svg+xml') bypasses the fileUpload.fileExtensions blocklist and is stored unchanged. On storage adapters that persist and serve the uploaded Content-Type (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed value and falls back to MIME-sniffing; a file whose body begins with HTML is rendered as HTML, executing embedded script in the application's origin against other users who open the file URL. The default GridFS storage adapter is not affected. Fixed in 9.10.0-alpha.2 and 8.6.84.
Patch / fix
- npm parse-server 8.6.84, 9.10.0-alpha.2
- bitnami parse 8.6.84, 9.10.0
- parse-community parse-server 8.6.84, 9.10.0-alpha.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N |
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | parse-server | >=9.0.0, <9.10.0-alpha.2 <8.6.84 |
9.10.0-alpha.2 8.6.84 |
| bitnami | parse | <8.6.84 >=9.0.0, <9.10.0 |
8.6.84 9.10.0 |
Affected products
- parse-community parse-server
Classification
- Weakness
-
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
-
github.com
/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r
vendor-advisory, web
-
vulncheck.com
/advisories/parse-server-stored-xss-via-malformed-content-type
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-61448
advisory, web
-
github.com
/parse-community/parse-server
package
Sources
- CVE List CVE-2026-61448
- GitHub Advisory GHSA-r899-h629-j84r
- NVD CVE-2026-61448
- OSV BIT-parse-2026-61448
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.