Is there a patch available for CVE-2026-61448?

Yes, a patch is available for CVE-2026-61448. Update the affected software to the latest version immediately.

Parse Server CVE-2026-61448

Q: What is the CVSS score of CVE-2026-61448?

CVE-2026-61448 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

Q: Which versions of Parse Server are affected by CVE-2026-61448?

Stored XSS execution in Parse Server (versions 9.0.0 through pre-9.10.0-alpha.2 and all 8.x releases through 8.6.83) allows authenticated users with file-upload permissions to inject persistent…. A patch is available.

EUVD-2026-43183 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-11 VulnCheck

GHSA-p6c5-mjgj-m4rm

XSS Google Microsoft File Upload Parse Server Parse Community

2.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

AC:H reflects the non-default cloud storage adapter requirement; PR:L for authenticated upload; S:C and C:L/I:L capture same-origin script execution against other users.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 11, 2026 - 15:01 EUVD

Analysis Generated

Jul 11, 2026 - 14:11 vuln.today

DescriptionCVE.org

Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid type/subtype media type (e.g., 'image', 'image/', or 'image//svg+xml') bypasses the fileUpload.fileExtensions blocklist and is stored unchanged. On storage adapters that persist and serve the uploaded Content-Type (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed value and falls back to MIME-sniffing; a file whose body begins with HTML is rendered as HTML, executing embedded script in the application's origin against other users who open the file URL. The default GridFS storage adapter is not affected. Fixed in 9.10.0-alpha.2 and 8.6.84.

AnalysisAI

Stored XSS execution in Parse Server (versions 9.0.0 through pre-9.10.0-alpha.2 and all 8.x releases through 8.6.83) allows authenticated users with file-upload permissions to inject persistent JavaScript that executes in the application's origin against other users, but only when a cloud-based storage adapter is configured. By crafting a deliberately malformed Content-Type header - such as 'image' or 'image/' - an attacker exploits a gap in the mime-package lookup path that renders the fileUpload.fileExtensions blocklist ineffective, causing the malformed value to be stored verbatim in Amazon S3, Google Cloud Storage, or Azure Blob Storage. Browsers receiving a syntactically invalid Content-Type fall back to MIME sniffing and render HTML file bodies as web pages in the application's origin; no public exploit has been identified and the vulnerability is absent from CISA KEV, but the stored nature means a single successful upload persists as a live threat until patched or the file is removed.

Technical ContextAI

Parse Server (cpe:2.3:a:parse-community:parse-server) is an open-source Backend-as-a-Service framework widely used to power mobile and web application backends. The flaw is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) but manifests through a Content-Type preservation code path rather than a classic extension bypass. When the 'mime' npm package cannot identify a file type by extension, Parse Server falls back to the client-provided Content-Type; a syntactically malformed value such as 'image' or 'image/' does not match any entry in the fileUpload.fileExtensions blocklist (which expects well-formed type/subtype tokens), causing the upload to pass validation with the malformed header stored verbatim. Cloud storage adapters - Amazon S3, Google Cloud Storage (referenced by the 'Google' tag), and Azure Blob Storage (referenced by the 'Microsoft' tag) - persist and re-serve this stored Content-Type on subsequent GET requests. Per RFC 2616, browsers that cannot parse the Content-Type value fall back to MIME sniffing the response body; a file whose content begins with HTML is then rendered as text/html in the application's origin, enabling full same-origin JavaScript execution. The default GridFS storage adapter does not preserve or re-serve the client-supplied Content-Type in the same manner and is explicitly not affected.

RemediationAI

Upgrade to Parse Server 9.10.0-alpha.2 (9.x branch) or 8.6.84 (8.x branch), as confirmed by the vendor security advisory at https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r. If an immediate upgrade is not possible for deployments using cloud storage adapters, reconfigure fileUpload.fileExtensions to use an explicit allowlist of permitted extensions (e.g., only 'jpg|png|gif|pdf') rather than a blocklist, so files with unrecognized extensions are rejected outright rather than passed through with a client-supplied Content-Type; note this may break uploads of uncommon but legitimate file types and requires testing. A complementary control at the storage layer is to configure the S3 bucket, GCS bucket, or Azure container to enforce Content-Disposition: attachment on all served files, preventing inline browser rendering regardless of Content-Type; this must be applied via bucket policy or CDN configuration and does not require a Parse Server change. Operators who do not require file upload functionality may disable it entirely by setting fileUpload.enableForPublic, enableForAnonymousUser, and enableForAuthenticatedUser to false, eliminating the attack surface completely at the cost of that feature.