EUVD-2026-36539
GHSA-7wqv-xjf3-x35v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the required S3/GCS cloud adapter (non-default); PR:L for authenticated upload; UI:R for victim browser open; S:C because XSS crosses into victim browser scope.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.79 and 9.9.1-alpha.4, the default file upload extension blocklist can be bypassed by appending a trailing dot to a filename whose extension would otherwise be blocked (e.g. poc.svg.). The trailing dot causes the extension parser to extract an empty string, which short-circuits the blocklist check, and the attacker-controlled Content-Type is forwarded to the storage adapter unchanged. Storage adapters that persist and serve the provided Content-Type (such as S3 or GCS) then serve the file with an active type such as image/svg+xml, enabling stored XSS when a victim opens the file URL. The default GridFS adapter is not affected because it sets X-Content-Type-Options: nosniff on responses. This issue has been patched in versions 8.6.79 and 9.9.1-alpha.4.
AnalysisAI
Stored XSS in Parse Server is achievable by authenticated users who bypass the file upload extension blocklist by appending a trailing dot to a blocked filename (e.g., poc.svg.), causing the extension parser to return an empty string and skip the block check. The attacker-supplied Content-Type is forwarded unchanged to cloud storage adapters (S3, GCS), which persist and serve the file under that active MIME type - enabling script execution in a victim's browser when the file URL is opened. No active exploitation is confirmed (not in CISA KEV, EPSS 0.05% at 15th percentile), but the attack mechanism is low-complexity and fully documented in the vendor's fix PRs. Patches are available in versions 8.6.79 and 9.9.1-alpha.4.
Technical ContextAI
Parse Server (cpe:2.3:a:parse-community:parse-server:*) is a Node.js open-source backend framework offering file upload capabilities with a configurable extension blocklist designed to prevent dangerous types such as SVG from being stored. The CWE-434 root cause (Unrestricted Upload of File with Dangerous Type) manifests through a logic flaw in the extension parser: a filename terminated by a trailing dot (e.g., poc.svg.) causes the parser to extract an empty string as the extension, which short-circuits the blocklist comparison and allows the upload to proceed. Critically, the attacker-controlled Content-Type header (e.g., image/svg+xml) is then forwarded as-is to the configured storage adapter. Cloud adapters such as AWS S3 and Google Cloud Storage persist and re-serve this Content-Type, meaning browsers fetch and render the SVG with full script execution. The default GridFS adapter is immune because it unconditionally injects X-Content-Type-Options: nosniff on responses, preventing MIME-type-based rendering. The fix PRs (#10489, #10490) introduce a Utils.getFileExtension function that trims trailing dots and whitespace before extension comparison.
RemediationAI
Upgrade Parse Server to version 8.6.79 (stable) or 9.9.1-alpha.4 (alpha), both confirmed by the vendor advisory GHSA-7wqv-xjf3-x35v and the fix commits in PRs #10489 and #10490 (https://github.com/parse-community/parse-server/pull/10489, https://github.com/parse-community/parse-server/pull/10490). If immediate upgrade is not feasible, set fileUpload.enableForPublic: false in the Parse Server configuration to restrict uploads to authenticated sessions only - this does not eliminate the risk for deployments where lower-trust authenticated users can upload, but it removes the unauthenticated attack surface. For S3 or GCS deployments, configure a bucket-level Content-Type override policy or a response header rule to force Content-Type: application/octet-stream and add X-Content-Type-Options: nosniff on served objects; this prevents browser rendering of SVG and similar active types without affecting application functionality. Migrating to the GridFS adapter fully eliminates the vulnerability but may not be architecturally feasible for production deployments. No workaround fully substitutes for the patch.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today