CVE-2026-55778CWE-434

Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist

Low · published July 8, 2026

CVSS v4.0
2.1
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.11 and 8.6.81, the default fileUpload.fileExtensions blocklist could be bypassed by uploading a file with a non-standard or compound extension and dangerous content type, allowing storage adapters such as S3 and GCS to serve attacker-supplied active content and enable stored cross-site scripting. This issue is fixed in versions 9.9.1-alpha.11 and 8.6.81.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00553 · 45.5th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-07-08T20:50Z
EPSS history
Timeline
  • 08 JUL 20:50Z
    Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist
    cvelistv5