LOW GitHub
CVE-2026-61448
Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist
### Impact
Parse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the `mime` package, Parse Server preserves the client-supplied `Content-Type` and passes it to the storage adapter. A malformed `Content-Type` that is not a valid `type/subtype` media type — for example `ima
Affected Products
- npm/parse-server >= 9.0.0, < 9.10.0-alpha.2
- npm/parse-server <= 8.6.83
References
- https://github.com/advisories/GHSA-r899-h629-j84r
- https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r
- https://nvd.nist.gov/vuln/detail/CVE-2026-61448
- https://www.vulncheck.com/advisories/parse-server-stored-xss-via-malformed-content-type
This low severity vulnerability was published on 2026-10-29 via GitHub. Affected: npm/parse-server >= 9.0.0, < 9.10.0-alpha.2, npm/parse-server <= 8.6.83.
vulnfeed aggregates 16884 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.