CVE-2026-61448 Details

A stored cross-site scripting vulnerability has been identified in Parse Server versions 9.0.0 prior to 9.10.0-alpha.2 and 8.6.83 and prior. The issue arises when an uploaded file's extension is unrecognized by the mime package, leading Parse Server to retain the client-supplied Content-Type. Malformed Content-Types that do not conform to valid type/subtype media type standards can bypass the file upload extension blocklist and are stored as-is. On storage adapters that serve the uploaded Content-Type, such as Amazon S3, Google Cloud Storage, or Azure Blob Storage, browsers revert to MIME-sniffing. If a file's content starts with HTML, it is rendered as such, executing any embedded scripts in the application's origin for users who access the file URL. The default GridFS storage adapter is not vulnerable, as it recalculates the Content-Type from the filename and serves files with X-Content-Type-Options set to nosniff.

Users can update to Parse Server versions 9.10.0-alpha.2 or 8.6.84, where this vulnerability has been patched. As an additional step, configure the file upload handler to validate the client-supplied Content-Type, ensuring it is a well-formed media type. For applications using storage adapters that serve the original Content-Type, consider implementing a strict allowlist for file extensions and serving uploaded files from a separate domain to isolate any rendered content from the application's origin.