CVE-2026-61448

Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

Parse Server's file upload validation uses the fileUpload.fileExtensions option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type and passes it to the storage adapter. A malformed Content-Type that is not a valid type/subtype media type, for example image (no subtype), image/ (empty subtype), or image//svg+xml (invalid token), bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded Content-Type (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed Content-Type and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the Content-Type from the filename and serves files with X-Content-Type-Options: nosniff.

The application accepts file uploads without adequately restricting the file type or content. Typical impact: remote code execution if the uploaded file can be served and executed on the server.

Kodem intelligence

Already deployed Kodem?

The file upload handler now validates that the client-supplied Content-Type is a well-formed media type (type/subtype with non-empty tokens per RFC 9110 §5.6.2) whenever the filename extension is not recognized by mime. Malformed values are rejected instead of being stored, while well-formed types, including custom or vendor types that the mime package does not recognize, continue to be accepted; only blocklisted subtypes are rejected.

1. What is CVE-2026-61448? CVE-2026-61448 is a low-severity unrestricted upload of dangerous file types vulnerability in parse-server (npm), affecting versions >= 9.0.0, < 9.10.0-alpha.2. It is fixed in 9.10.0-alpha.2, 8.6.84. The application accepts file uploads without adequately restricting the file type or content.
2. Which versions of parse-server are affected by CVE-2026-61448? parse-server (npm) versions >= 9.0.0, < 9.10.0-alpha.2 is affected.
3. Is there a fix for CVE-2026-61448? Yes. CVE-2026-61448 is fixed in 9.10.0-alpha.2, 8.6.84. Upgrade to this version or later.
4. Is CVE-2026-61448 exploitable, and should I be worried? Whether CVE-2026-61448 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-61448 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-61448?
   • Upgrade parse-server to 9.10.0-alpha.2 or later
   • Upgrade parse-server to 8.6.84 or later

Other vulnerabilities in parse-server