CVE-2026-53724 Details

A stored cross-site scripting vulnerability has been identified in Parse Server versions prior to 8.6.79 and 9.9.1-alpha.4. The issue arises from a bypass of the default file upload extension blocklist. By appending a trailing dot to a filename with a blocked extension, the extension parser extracts an empty string, circumventing the blocklist. This allows the attacker-controlled Content-Type to be forwarded to the storage adapter without modification. Storage adapters that serve the provided Content-Type, such as S3 or GCS, can then deliver the file with an active type like image/svg+xml, enabling stored XSS when the file URL is accessed by a victim. The default GridFS adapter is not vulnerable as it applies X-Content-Type-Options: nosniff to responses.

Users can upgrade to Parse Server versions 8.6.79 or 9.9.1-alpha.4 to address this vulnerability. Alternatively, the storage adapter or CDN can be configured to derive Content-Type from the filename extension instead of using the stored Content-Type, or the default blocklist can be replaced with an explicit allowlist of needed file extensions.