Answer in brief
CVE-2026-61448 records a Low severity (CVSS 2.1) vulnerability in Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist. The current sources do not mark it as known exploited. The current feed maps parse-server (npm), parse-server (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 2.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps parse-server (npm), parse-server (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| parse-servernpm | <=8.6.83 | 8.6.84 |
| parse-servernpm | >=9.0.0,<9.10.0-alpha.2 | 9.10.0-alpha.2 |
Published upstream
Jul 11, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Oct 29, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Jul 13, 2026
### Impact Parse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the `mime` package, Parse Server preserves the client-supplied `Content-Type` and passes it to the storage adapter. A malformed `Content-Type` that is not a valid `type/subtype` media type — for example `image` (no subtype), `image/` (empty subtype), or `image//svg+xml` (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded `Content-Type` (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed `Content-Type` and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the `Content-Type` from the filename and serves files with `X-Content-Type-Options: nosniff`. ### Patches The file upload handler now validates that the client-supplied `Content-Type` is a well-formed media type (`type/subtype` with non-empty tokens per RFC 9110 §5.6.2) whenever the filename extension is not recognized by `mime`. Malformed values are rejected instead of being stored, while well-formed types — including custom or vendor types that the `mime` package does not recognize — continue to be accepted; only blocklisted subtypes are rejected. ### Workarounds Configure `fileUpload.fileExtensions` as a strict allowlist of only the extensions the application needs (for example `["^(png|jpe?g|gif|pdf)$"]`). Additionally, serve uploaded files from a domain separate from the application so that any rendered content is isolated from the application's origin, and configure the storage/CDN layer to send `X-Content-Type-Options: nosniff`. ### References - GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r - Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10521 - Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10523
Quoted source text, attributed separately from HOL analysis.