CVE-2026-35200 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73 and 9.7.1-alpha.4, a file can be uploaded with a filename extension that passes the file extension allowlist (e.g., .txt) but with a Content-Type header that differs from the extension (e.g., text/html). The Content-Type is passed to the storage adapter without consistency validation. Storage adapters that store and serve the provided Content-Type (such as S3 or GCS) serve the file with the mismatched Content-Type. The default GridFS adapter is not affected because it derives Content-Type from the filename at serving time. This vulnerability is fixed in 8.6.73 and 9.7.1-alpha.4.
A vulnerability exists in Parse Server versions 8.6.72 and prior to 9.7.1-alpha.4, allowing files to be uploaded with a filename extension that bypasses the extension allowlist. The issue arises when the Content-Type header does not match the extension, such as uploading a file with a .txt extension but a text/html Content-Type. This mismatch is not validated before being passed to the storage adapter. As a result, storage adapters like S3 or GCS, which serve files with the provided Content-Type, will deliver the file with the incorrect type. However, the default GridFS adapter is not impacted, as it determines the Content-Type based on the filename at the time of serving.
Users can update to Parse Server versions 9.7.1-alpha.4 or 8.6.73, where this vulnerability has been patched. Alternatively, configure the storage adapter or CDN to derive the Content-Type from the filename extension instead of using the stored Content-Type.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/pull/10383 | [email protected] | Issue TrackingPatch |
| https://github.com/parse-community/parse-server/pull/10384 | [email protected] | Issue TrackingPatch |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-vr5f-2r24-w5hc | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-436 | Interpretation Conflict | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse-server | < 8.6.73 >= 9.0.0, < 9.7.1 9.7.1 alpha1 9.7.1 alpha2 9.7.1 alpha3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |