CVE-2026-55778
LowCVSS 2.1Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability in Parse Server allows bypassing the default file upload extension blocklist by uploading a file with a non-standard or compound extension and dangerous content type. This enables storage adapters like S3 and GCS to serve attacker-supplied active content, leading to stored cross-site scripting (XSS).
Risk Assessment
The risk involves potential execution of malicious scripts in users' browsers, which could lead to session theft, data leakage, or further attacks on the organization.
Recommendation
It is recommended to immediately update Parse Server to version 9.9.1-alpha.11 or 8.6.81, which contain the fix for this vulnerability.
Original NVD description (English source)
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.11 and 8.6.81, the default fileUpload.fileExtensions blocklist could be bypassed by uploading a file with a non-standard or compound extension and dangerous content type, allowing storage adapters such as S3 and GCS to serve attacker-supplied active content and enable stored cross-site scripting. This issue is fixed in versions 9.9.1-alpha.11 and 8.6.81.