CVE-2026-61448: Parse Server 9.0.0 Stored XSS via malformed Content-Type
Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid type/subtype media type (e.g., 'image', 'image/', or 'image//svg+xml') bypasses the fileUpload.fileExtensions blocklist and is stored unchanged. On storage adapters that persist and serve the uploaded Content-Type (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed value and falls back to MIME-sniffing; a file whose body begins with HTML is rendered as HTML, executing embedded script in the application's origin against other users who open the file URL. The default GridFS storage adapter is not affected. Fixed in 9.10.0-alpha.2 and 8.6.84.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.10.0-alpha.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.6.84 - Compensating control
On storage adapters that persist and serve the uploaded Content-Type (e.g., Amazon S3, Google Cloud Storage, Azure Blob Storage), consider mitigating MIME-sniffing impact of malformed Content-Type values until upgraded (e.g., use a storage/response configuration that prevents serving or parsing attacker-controlled Content-Type and reduces HTML MIME-sniffing).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61448?
The severity of CVE-2026-61448 is rated low, with a CVSS score of 4.0.
How do I fix CVE-2026-61448?
To fix CVE-2026-61448, upgrade Parse Server to version 9.10.0-alpha.2 or higher.
What types of vulnerabilities does CVE-2026-61448 involve?
CVE-2026-61448 involves stored cross-site scripting (XSS) and malicious file upload vulnerabilities.
Which versions of Parse Server are affected by CVE-2026-61448?
CVE-2026-61448 affects Parse Server versions greater than or equal to 9.0.0 and less than 9.10.0-alpha.2, as well as version 8.6.83.
What is the exploit mechanism for CVE-2026-61448?
The exploit mechanism for CVE-2026-61448 involves an uploaded file with an unrecognized extension, allowing the client-supplied Content-Type to be preserved.