Parse Server: File upload Content-Type override via extension mismatch

Description

A file can be uploaded with a filename extension that passes the file extension allowlist (e.g., .txt) but with a Content-Type header that differs from the extension (e.g., text/html). The Content-Type is passed to the storage adapter without consistency validation.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **<= 8.6.72

  >= 9.0.0, < 9.7.1-alpha.4**

• Patched version(s): **8.6.73

  9.7.1-alpha.4**

References

• GHSA-vr5f-2r24-w5hc
• CVE-2026-35200
• CWE-436
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries - CVE-2026-32728
• Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload - CVE-2026-30948
• Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types - CVE-2026-31868
• Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format - CVE-2025-64430

You might also like:

Exploiting Server Version Disclosure

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

parse-server