CVE-2026-30948 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.4 and 8.6.17, a stored cross-site scripting (XSS) vulnerability allows any authenticated user to upload an SVG file containing JavaScript. The file is served inline with Content-Type: image/svg+xml and without protective headers, causing the browser to execute embedded scripts in the Parse Server origin. This can be exploited to steal session tokens from localStorage and achieve account takeover. The default fileExtensions option blocks HTML file extensions but does not block SVG, which is a well-known XSS vector. All Parse Server deployments where file upload is enabled for authenticated users (the default) are affected. This vulnerability is fixed in 9.5.2-alpha.4 and 8.6.17.
A stored cross-site scripting vulnerability has been identified in Parse Server versions 9.0.0 prior to 9.5.2-alpha.4 and versions prior to 8.6.17. This vulnerability allows authenticated users to upload SVG files containing JavaScript. The uploaded files are served inline with a Content-Type of image/svg+xml and without protective headers, enabling the execution of embedded scripts in the Parse Server origin. This exploitation can lead to the theft of session tokens from localStorage, resulting in account takeover. The default fileExtensions option in Parse Server blocks HTML file extensions but fails to restrict SVG uploads, which are a known vector for XSS attacks. All deployments of Parse Server with file upload enabled for authenticated users are vulnerable.
Users can upgrade to Parse Server versions 9.5.2-alpha.4 or 8.6.17 to address this vulnerability. Alternatively, for those using earlier versions, SVG uploads can be blocked by configuring the fileExtensions option to deny SVG files.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/releases/tag/8.6.17 | [email protected] | ProductRelease Notes |
| https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.4 | [email protected] | ProductRelease Notes |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-hcj7-6gxh-24ww | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse-server | < 8.6.17 >= 9.0.0, < 9.5.2 9.5.2 alpha1 9.5.2 alpha2 9.5.2 alpha3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |