CVE-2026-35200

Parse Server is a Node.js backend framework that provides file upload functionality through pluggable storage adapters. The vulnerability exists in the file upload pipeline where user-supplied Content-Type headers are passed to storage adapters (S3, GCS, etc.) without validation against the filename extension. This creates a TOCTOU-like inconsistency: the allowlist validation checks only the filename extension (enforcing safe extensions like .txt), but the Content-Type header-which controls how the file is interpreted by browsers and CDNs-is left under attacker control. Cloud storage services like AWS S3 and Google Cloud Storage respect the metadata Content-Type field when serving files, causing them to deliver .txt files with text/html Content-Type, triggering browser interpretation as HTML. The GridFS adapter (MongoDB's native storage) is not vulnerable because it reconstructs Content-Type from the filename at serving time, overriding stored metadata. The root cause is classified under CWE-436 (Interpretation Conflict), a variant of TOCTOU where different components interpret the same input differently. The affected product is the npm package parse-server across versions prior to the patch releases.