Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format

Description

A Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality when trying to upload a Parse.File with uri parameter allows to execute an arbitrary URI. The vulnerability stems from a file upload feature in which Parse Server retrieves the file data from a URI that is provided in the request.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 8.0.0, <= 8.4.0-alpha.1

  >= 4.2.0, < 7.5.4**

• Patched version(s): **8.4.0-alpha.2

  7.5.4**

References

• GHSA-x4qj-2f4q-r4rx
• CVE-2025-64430
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message - CVE-2025-64758
• `sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js` - CVE-2025-62381
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• matrix-js-sdk has insufficient validation when considering a room to be upgraded by another - CVE-2025-59160

Tags:

npm

parse-server