Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format

Description

A Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality when trying to upload a Parse.File with uri parameter allows to execute an arbitrary URI. The vulnerability stems from a file upload feature in which Parse Server retrieves the file data from a URI that is provided in the request.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 8.0.0, <= 8.4.0-alpha.1

  >= 4.2.0, < 7.5.4**

• Patched version(s): **8.4.0-alpha.2

  7.5.4**

References

• GHSA-x4qj-2f4q-r4rx
• CVE-2025-64430
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter - CVE-2025-68150
• uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) - CVE-2022-0086
• Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter - CVE-2025-58179
• HackMD MCP Server has Server-Side Request Forgery (SSRF) vulnerability - CVE-2025-59155

Tags:

npm

parse-server