CVE-2026-61448— Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid type/subtype media type (e.g., 'image', 'image/', or 'image//svg+xml') bypasses the fileUpload.fileExtensions blocklist and is stored unchanged. On storage adapters that persist and serve the uploaded Content-Type (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed value and falls back to MIME-sniffing; a file whose body begins with HTML is rendered as HTML, executing embedded script in the application's origin against other users who open the file URL. The default GridFS storage adapter is not affected. Fixed in 9.10.0-alpha.2 and 8.6.84.

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

危险类型文件的不加限制上传

Parse Platform Parse Server 任意文件上传漏洞

Parse Platform Parse Server是Parse Platform组织开源的一个开源后端,可以部署到任何可以运行 Node.js 的基础设施。 Parse Platform Parse Server 9.0.0版本至9.10.0-alpha.2之前版本和8.6.83及之前版本存在任意文件上传漏洞，该漏洞源于mime包无法识别上传文件扩展名时保留客户端提供的Content-Type，错误的Content-Type绕过fileUpload.fileExtensions黑名单，导致浏览器回退至

N/A

N/A