Iniciar sesión
Deutsch English Español Polski
Baja

parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist

  • Publicada: 19.06.2026
  • Actualizado: 11.10.2026 10:22

Impact

Parse Server's default fileUpload.fileExtensions blocklist is intended to prevent uploading files that browsers render as active content (such as HTML and SVG), which can be used to perform stored cross-site scripting (XSS) attacks against other users. The blocklist could be bypassed by uploading a file whose extension is not an exact match of a blocked extension (for example a non-standard or compound extension) together with a dangerous content type. On storage adapters that persist and serve the uploaded content type (such as S3 and GCS), the file is then served with the attacker-supplied content type, enabling stored XSS against users who open the file URL.

This affects the default configuration, in which authenticated users are allowed to upload files. The default GridFS/filesystem adapter sets the X-Content-Type-Options: nosniff response header, which mitigates browser rendering on that adapter, but the upload restriction itself is still bypassed. This is an incomplete-fix follow-up of GHSA-vr5f-2r24-w5hc and GHSA-7wqv-xjf3-x35v.

Patches

The file upload extension validation now also evaluates the request content type against the configured blocklist whenever the filename's extension is not a recognized type. As a result, a dangerous content type can no longer be preserved by uploading a file with a non-standard extension, and such uploads are rejected.

Workarounds

Configure fileUpload.fileExtensions as a strict allowlist of only the file extensions your application needs (for example ["^(png|jpe?g|gif|pdf)$"]) instead of relying on the default blocklist. Additionally, serve uploaded files from a separate domain than the application, so that any executed content is isolated from the application's origin.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de npm parse-server >= 9.0.0, < 9.9.1-alpha.11, < 8.6.81 9.9.1-alpha.11, 8.6.81

Referencias

Puntuación CVSS -
Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Debilidad (CWE)
CWE-434
Plataforma
npm
Paquete
parse-server
Publicada
19.06.2026
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-v8x7-r927-cc93 - CC BY 4.0

Historial de vulnerabilidades: parse-server

Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (116) en el archivo
Entradas en total
116
Primera → última
06.2019 06.2026
Sin corrección
0
Explotada en ataques
0

Distribución por gravedad

  • Crítica 17
  • Alta 49
  • Media 40
  • Baja 10

Divulgaciones por año

Gravedad:
  1. parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist esta entrada
    Baja CVE-2026-55778 >= 9.0.0, < 9.9.1-alpha.11, < 8.6.81 9.9.1-alpha.11, 8.6.81
  2. parse-server: Denial of service via exponential-time processing of deeply nested query operators
    Alta CVE-2026-57480 >= 9.0.0, < 9.9.1-alpha.12, < 8.6.82 9.9.1-alpha.12, 8.6.82
  3. Parse Server: Pre-authentication denial of service via client version header regex backtracking
    Alta CVE-2026-47138 >= 9.0.0, < 9.9.1-alpha.1, < 8.6.77 9.9.1-alpha.1, 8.6.77
  4. Parser Server's streaming file download bypasses afterFind file trigger authorization
    Alta CVE-2026-34784 >= 9.0.0, < 9.7.1-alpha.1, < 8.6.71 9.7.1-alpha.1, 8.6.71
  5. parse-server has GraphQL complexity validator exponential fragment traversal DoS
    Alta CVE-2026-34573 >= 9.0.0, < 9.7.0-alpha.12, < 8.6.68 9.7.0-alpha.12, 8.6.68
  6. parse-server has cloud function validator bypass via prototype chain traversal
    Crítica CVE-2026-34532 >= 9.0.0, < 9.7.0-alpha.11, < 8.6.67 9.7.0-alpha.11, 8.6.67
  7. LiveQuery protected field leak via shared mutable state across concurrent subscribers
    Alta CVE-2026-34363 >= 9.0.0, < 9.7.0-alpha.9, < 8.6.65 9.7.0-alpha.9, 8.6.65
  8. Parse Server exposes auth data via verify password endpoint
    Alta CVE-2026-34215 >= 9.0.0, < 9.7.0-alpha.7, < 8.6.63 9.7.0-alpha.7, 8.6.63
  9. Parse Server exposes auth data via /users/me endpoint
    Alta CVE-2026-33627 >= 9.0.0, < 9.6.0-alpha.55, < 8.6.61 9.6.0-alpha.55, 8.6.61
  10. Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
    Alta CVE-2026-33539 >= 9.0.0, < 9.6.0-alpha.53, < 8.6.59 9.6.0-alpha.53, 8.6.59
  11. Parse Server: Denial of Service via unindexed database query for unconfigured auth providers
    Alta CVE-2026-33538 >= 9.0.0, < 9.6.0-alpha.52, < 8.6.58 9.6.0-alpha.52, 8.6.58
  12. Parse Server LiveQuery subscription query depth bypass
    Alta · 7.5 CVE-2026-33508 >= 9.0.0, < 9.6.0-alpha.45, < 8.6.56 9.6.0-alpha.45, 8.6.56
  13. Parse Server has a query condition depth bypass via pre-validation transform pipeline
    Alta · 7.5 CVE-2026-33498 >= 9.0.0, < 9.6.0-alpha.44, < 8.6.55 9.6.0-alpha.44, 8.6.55
  14. Parse Server's LiveQuery bypasses CLP pointer permission enforcement
    Alta · 6.5 CVE-2026-33421 >= 9.0.0, < 9.6.0-alpha.42, < 8.6.53 9.6.0-alpha.42, 8.6.53
  15. Parse Server has an auth provider validation bypass on login via partial authData
    Alta · 9.1 CVE-2026-33409 >= 9.0.0, < 9.6.0-alpha.41, < 8.6.52 9.6.0-alpha.41, 8.6.52
  16. Parse Server leaks protected fields via LiveQuery afterEvent trigger
    Alta CVE-2026-33163 >= 9.0.0, < 9.6.0-alpha.35, < 8.6.50 9.6.0-alpha.35, 8.6.50
  17. Parse Server's Cloud function dispatch crashes server via prototype chain traversal
    Alta CVE-2026-32886 >= 9.0.0, < 9.6.0-alpha.24, < 8.6.47 9.6.0-alpha.24, 8.6.47
  18. Parse Server crash via deeply nested query condition operators
    Alta CVE-2026-32944 >= 9.0.0, < 9.6.0-alpha.21, < 8.6.45 9.6.0-alpha.21, 8.6.45
  19. Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
    Alta CVE-2026-32728 >= 9.0.0, < 9.6.0-alpha.15, < 8.6.41 9.6.0-alpha.15, 8.6.41
  20. Parse Server: Account takeover via operator injection in authentication data identifier
    Crítica CVE-2026-32248 >= 9.0.0, < 9.6.0-alpha.12, < 8.6.38 9.6.0-alpha.12, 8.6.38
  21. Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
    Crítica CVE-2026-32242 >= 9.0.0, < 9.6.0-alpha.11, < 8.6.37 9.6.0-alpha.11, 8.6.37
  22. Parse Server's MFA recovery codes not consumed after use
    Alta CVE-2026-31875 >= 9.0.0-alpha.1, < 9.6.0-alpha.7, < 8.6.33 9.6.0-alpha.7, 8.6.33
  23. Parse Server has a protected fields bypass via dot-notation in query and sort
    Alta CVE-2026-31872 >= 9.0.0-alpha.1, < 9.6.0-alpha.6, < 8.6.32 9.6.0-alpha.6, 8.6.32
  24. Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
    Crítica CVE-2026-31871 >= 9.0.0-alpha.1, < 9.6.0-alpha.5, < 8.6.31 9.6.0-alpha.5, 8.6.31
  25. Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL
    Crítica CVE-2026-31856 >= 9.0.0-alpha.1, < 9.6.0-alpha.3, < 8.6.29 9.6.0-alpha.3, 8.6.29
  26. Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
    Alta CVE-2026-31800 >= 9.0.0-alpha.1, < 9.5.2-alpha.12, < 8.6.25 9.5.2-alpha.12, 8.6.25
  27. Parse Server OAuth2 authentication adapter account takeover via identity spoofing
    Alta CVE-2026-30967 >= 9.0.0-alpha.1, < 9.5.2-alpha.9, < 8.6.22 9.5.2-alpha.9, 8.6.22
  28. Parse Server has role escalation and CLP bypass via direct `_Join` table write
    Crítica · 10.0 CVE-2026-30966 >= 9.0.0-alpha.1, < 9.5.2-alpha.7, < 8.6.20 9.5.2-alpha.7, 8.6.20
  29. Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter
    Crítica CVE-2026-30965 >= 9.0.0-alpha.1, < 9.5.2-alpha.8, < 8.6.21 9.5.2-alpha.8, 8.6.21
  30. Parse Server has a protected fields bypass via logical query operators
    Alta CVE-2026-30962 >= 9.0.0, < 9.5.2-alpha.6, < 8.6.19 9.5.2-alpha.6, 8.6.19
  31. Parse Server missing audience validation in Keycloak authentication adapter
    Alta CVE-2026-30949 >= 9.0.0, < 9.5.2-alpha.5, < 8.6.18 9.5.2-alpha.5, 8.6.18
  32. Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload
    Alta CVE-2026-30948 >= 9.0.0, < 9.5.2-alpha.4, < 8.6.17 9.5.2-alpha.4, 8.6.17
  33. Parse Server has a bypass of class-level permissions in LiveQuery
    Alta CVE-2026-30947 >= 9.0.0, < 9.5.2-alpha.3, < 8.6.16 9.5.2-alpha.3, 8.6.16
  34. Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
    Alta CVE-2026-30946 < 8.6.15, >= 9.0.0, < 9.5.2-alpha.2 8.6.15, 9.5.2-alpha.2
  35. Parse Server has a NoSQL injection via token type in password reset and email verification endpoints
    Alta CVE-2026-30941 >= 9.0.0, < 9.5.2-alpha.1, < 8.6.14 9.5.2-alpha.1, 8.6.14
  36. Parse Server: SQL injection via dot-notation field name in PostgreSQL
    Crítica CVE-2026-31840 >= 9.0.0, < 9.6.0-alpha.2, < 8.6.28 9.6.0-alpha.2, 8.6.28
  37. Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
    Alta CVE-2026-30939 < 8.6.13, >= 9.0.0-alpha.1, < 9.5.1-alpha.2 8.6.13, 9.5.1-alpha.2
  38. Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
    Alta CVE-2026-30925 >= 9.0.0-alpha.1, < 9.5.0-alpha.14, < 8.6.11 9.5.0-alpha.14, 8.6.11
  39. Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
    Crítica CVE-2026-30863 >= 9.0.0-alpha.1, < 9.5.0-alpha.11, < 8.6.10 9.5.0-alpha.11, 8.6.10
  40. parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
    Alta CVE-2026-30229 < 8.6.6, >= 9.0.0, < 9.5.0-alpha.4 8.6.6, 9.5.0-alpha.4
Mostrar más (20) Mostrando 40 de 67

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.