Live › vulnerability › CVE-2026-61448
Parse Server stores uploaded files with a malformed Content-Type that bypasses its extension blocklist when the file extension is not recognized by the mime package. On storage adapters that serve the stored Content-Type (such as S3, Google Cloud Storage, or Azure Blob Storage), a browser may MIME-sniff an HTML-bearing file and run its script in the application's origin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:33 UTC, 0h before NVD. All times on this page are UTC.
Applications that run Parse Server 9.0.0 up to but not including 9.10.0-alpha.2, or 8.6.83 and earlier, and let users upload files to a non-GridFS storage adapter that serves the stored Content-Type. Exposure requires a user permitted to upload files, and a victim opening the file URL; deployments using the default GridFS adapter are not affected, and those with a strict allowlist of extensions are unlikely to be affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| parse-server | npm | >= 9.0.0, < 9.10.0-alpha.2 | 9.10.0-alpha.2 |
| parse-server | npm | <= 8.6.83 | 8.6.84 |
parse-server version in package.json or npm ls parse-server.fileUpload.fileExtensions is set and whether the storage adapter is S3, GCS or Azure Blob rather than the default GridFS adapter.parse-server 9.x: upgrade to 9.10.0-alpha.2 or later.parse-server 8.x: upgrade to 8.6.84 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server's file upload validation uses the fileUpload.fileExtensions option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type and passes it to the storage adapter. A malformed Content-Type that is not a valid type/subtype media type — for example image (no subtype), image/ (empty subtype), or image//svg+xml (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded Content-Type (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed Content-Type and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the Content-Type from the filename and serves files with X-Content-Type-Options: nosniff.
The file upload handler now validates that the client-supplied Content-Type is a well-formed media type (type/subtype with non-empty tokens per RFC 9110 §5.6.2) whenever the filename extension is not recognized by mime. Malformed values are rejected instead of being stored, while well-formed types — including custom or vendor types that the mime package does not recognize — continue to be accepted; only blocklisted subtypes are rejected.
Configure fileUpload.fileExtensions as a strict allowlist of only the extensions the application needs (for example ["^(png|jpe?g|gif|pdf)$"]). Additionally, serve uploaded files from a domain separate from the application so that any rendered content is isolated from the application's origin, and configure the storage/CDN layer to send X-Content-Type-Options: nosniff.
This page as .md · .json · in your agent: get_signal("CVE-2026-61448")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.