CVE-2026-55778 | Parse Server is an open source backend that can be deployed … | CVSS 2.1 LOW

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.11 and 8.6.81, the default fileUpload.fileExtensions blocklist could be bypassed by uploading a file with a non-standard or compound extension and dangerous content type, allowing storage adapters such as S3 and GCS to serve attacker-supplied active content and enable stored cross-site scripting. This issue is fixed in versions 9.9.1-alpha.11 and 8.6.81.

Metadata

CVE ID: CVE-2026-55778
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-17 14:40 UTC
Published: 2026-07-08 20:50 UTC
Last updated: 2026-07-09 13:39 UTC
Primary CWE: CWE-434
CWE-434: Unrestricted Upload of File with Dangerous Type
Vendor / Product: parse-community / parse-server
Sources: cve.org · NVD

Severity & Metrics

2.1 LOW CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
parse-community	parse-server	—	>= 9.0.0-alpha.1, < 9.9.1-alpha.11, < 8.6.81

Weakness (CWE)

CWE	Source	Description
CWE-434	cna	CWE-434: Unrestricted Upload of File with Dangerous Type

CVSS scores (1)

Score	Severity	Version	Source	Vector
2.1	LOW	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

References (7)

https://github.com/parse-community/parse-server/security/advisories/GHSA-v8x7-r927-cc93 https://github.com/parse-community/parse-server/security/advisories/GHSA-v8x7-r927-cc93
https://github.com/parse-community/parse-server/pull/10505 https://github.com/parse-community/parse-server/pull/10505
https://github.com/parse-community/parse-server/pull/10506 https://github.com/parse-community/parse-server/pull/10506
https://github.com/parse-community/parse-server/commit/97c6a78d19f976ec756c1295f08a8fccab90799a https://github.com/parse-community/parse-server/commit/97c6a78d19f976ec756c1295f08a8fccab90799a
https://github.com/parse-community/parse-server/commit/be12a60d65b6e140481882037fb896b1f951df50 https://github.com/parse-community/parse-server/commit/be12a60d65b6e140481882037fb896b1f951df50
https://github.com/parse-community/parse-server/releases/tag/8.6.81 https://github.com/parse-community/parse-server/releases/tag/8.6.81
https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.11 https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.11