BIT-parse-2026-61448

    Dashboard / Vulnerabilities / BIT-parse-2026-61448

    BIT-parse-2026-61448

    Published: 25 Sept 2026Last Modified: 25 Sept 2026

    Summary: Parse Server 9.0.0 Stored XSS via malformed Content-Type

    Details: Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0 and <= 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid type/subtype media type (e.g., 'image', 'image/', or 'image//svg+xml') bypasses the fileUpload.fileExtensions blocklist and is stored unchanged. On storage adapters that persist and serve the uploaded Content-Type (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed value and falls back to MIME-sniffing; a file whose body begins with HTML is rendered as HTML, executing embedded script in the application's origin against other users who open the file URL. The default GridFS storage adapter is not affected. Fixed in 9.10.0 and 8.6.84.

    References: https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r, https://nvd.nist.gov/vuln/detail/CVE-2026-61448, https://www.vulncheck.com/advisories/parse-server-stored-xss-via-malformed-content-type

    Affected packages

    Package

    Name: parse

    Purl: pkg:bitnami/parse

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -8.6.84

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-parse-2026-61448 | CVE-DB