Parse Server CVE-2026-109301

Exploitation requires the target Parse Server class to have at least one Cloud Code save, find, or delete trigger OR LiveQuery enabled, AND the attacker to be able to write to that class. Unauthenticated exploitation is possible only when the deployment permits public write access or open user sign-up; instances that enforce authenticated write via ACLs/Class-Level Permissions require a valid account with write rights, limiting exposure. The specific trigger is writing an object containing a file reference that lacks a URL. The flaw is fixed in 8.6.95 and 9.10.2-alpha.3 (for the 9.x line), so unpatched versions below those are the limiting version condition; impact is confined to availability.

This is a denial-of-service vulnerability (CWE-248, uncaught exception) with a genuine but bounded risk profile. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 8.2 and shows a network-reachable, low-complexity flaw requiring no privileges but carrying an attack requirement (AT:P) - consistent with the description, which conditions exploitation on the target class having Cloud Code save/find/delete triggers or LiveQuery enabled and on the attacker being able to write to it. Impact is availability-only (VC:N/VI:N/VA:H): there is no data exposure or integrity loss, only process termination or broken subsequent requests. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the high base score is driven entirely by easy remote reachability of an availability impact, not by confirmed in-the-wild activity. Net assessment: a real, patch-worthy priority for internet-exposed Parse Server deployments that permit public write or open sign-up, but materially lower urgency than the 8.2 suggests for instances that restrict write access via ACLs/CLPs - the AT:P requirement and the trigger/LiveQuery precondition are the key mitigating signals.

An attacker targets an internet-facing Parse Server instance that allows public write access or open sign-up and has a class with Cloud Code save/find/delete triggers or LiveQuery enabled. They submit an object containing a file reference that lacks a URL; when the server passes the object to the trigger or LiveQuery pipeline without resolving the reference, an uncaught exception is thrown and the Node.js process terminates or subsequent requests break. No public exploit code was identified in the provided data.