CVE-2026-30848 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.8 and 9.5.0-alpha.8, the PagesRouter static file serving route is vulnerable to a path traversal attack that allows unauthenticated reading of files outside the configured pagesPath directory. The boundary check uses a string prefix comparison without enforcing a directory separator boundary. An attacker can use path traversal sequences to access files in sibling directories whose names share the same prefix as the pages directory (e.g. pages-secret starts with pages). This issue has been patched in versions 8.6.8 and 9.5.0-alpha.8.
A path traversal vulnerability has been identified in the PagesRouter static file serving route of Parse Server, affecting versions prior to 8.6.8 and 9.0.0 through 9.5.0-alpha.8. The vulnerability allows unauthenticated users to read files outside the designated pagesPath directory. This issue arises because the boundary check relies on a string prefix comparison without properly enforcing directory separator boundaries. As a result, an attacker can exploit path traversal sequences to access files in sibling directories that share the same prefix as the pages directory, such as 'pages-secret'. The vulnerability impacts any Parse Server deployment with the 'pages' feature enabled, provided there is a sibling directory of pagesPath with a name prefix matching that of the pages directory.
Users can upgrade to Parse Server versions 8.6.8 or 9.5.0-alpha.8, where this vulnerability has been patched. For those unable to upgrade, a workaround is to ensure that the pagesPath directory does not have sibling directories with names beginning the same prefix, such as 'pages-backup' or 'pages_old'.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/security/advisories/GHSA-hm3f-q6rw-m6wh | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse-server | < 8.6.8 >= 9.0.0, < 9.5.0 9.5.0 alpha1 9.5.0 alpha2 9.5.0 alpha3 9.5.0 alpha4 9.5.0 alpha5 9.5.0 alpha6 9.5.0 alpha7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | Initial Analysis | [email protected] |
| Mar 7, 2026 | New CVE Received | [email protected] |