CVE-2026-61448: Parse Server Stored XSS Vulnerability

CVE-2026-61448 Overview

CVE-2026-61448 is a stored cross-site scripting (XSS) vulnerability in Parse Server, an open-source backend framework. The flaw affects versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83. Parse Server fails to sanitize client-supplied Content-Type headers when the uploaded file's extension is not recognized by the mime package. Attackers can bypass the fileUpload.fileExtensions blocklist by submitting a malformed media type such as image, image/, or image//svg+xml. When the file is served from external storage adapters, browsers fall back to MIME-sniffing and render attacker-controlled HTML, executing script in the application's origin. This issue is tracked under [CWE-434] (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Authenticated attackers can store malicious HTML files that execute JavaScript in the application origin against any user who opens the file URL, enabling session theft and account takeover.

Affected Products

Parse Server versions 9.0.0 through 9.10.0-alpha.1
Parse Server versions up to and including 8.6.83
Deployments using Amazon S3, Google Cloud Storage, or Azure Blob Storage adapters

Discovery Timeline

2026-07-11 - CVE-2026-61448 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-61448

Vulnerability Analysis

Parse Server relies on the mime package to validate uploaded file extensions against the fileUpload.fileExtensions blocklist. When the package does not recognize an extension, Parse Server preserves the Content-Type value supplied by the client without further validation. A malformed value that is not a valid type/subtype media type slips past the blocklist logic entirely.

Affected storage adapters, including Amazon S3, Google Cloud Storage, and Azure Blob Storage, persist and serve the malformed Content-Type header verbatim. Browsers receiving an unparseable media type invoke MIME-sniffing on the response body. Content beginning with HTML markup is rendered as text/html, executing embedded JavaScript in the origin of the Parse Server application.

The default GridFS storage adapter is not affected because it does not preserve the raw client-supplied Content-Type in the same manner.

Root Cause

The root cause is improper input validation of the Content-Type request header combined with a bypassable blocklist. The extension-checking logic assumes mime-package recognition and does not enforce that the Content-Type conforms to RFC 6838 media type syntax. Values such as image, image/, or image//svg+xml propagate to storage unchanged.

Attack Vector

An attacker with file-upload privileges submits a file with an unrecognized extension and a malformed Content-Type header. The file body contains HTML and JavaScript payloads. Parse Server accepts the upload and forwards the malformed header to the external storage backend. When a victim navigates to the file URL, the browser cannot parse the media type, sniffs the content, and renders it as HTML. The embedded script then runs under the application's origin, exposing session cookies and authenticated API access.

No verified public exploit code has been released. See the GitHub Security Advisory and the VulnCheck Stored XSS Advisory for technical details.

Detection Methods for CVE-2026-61448

Indicators of Compromise

Objects in S3, GCS, or Azure Blob Storage with Content-Type values that do not conform to type/subtype syntax, such as image, image/, or image//svg+xml.
Uploaded files whose byte content begins with <html, <script, or <svg but whose stored metadata suggests an image type.
Unexpected outbound requests originating from browsers that recently accessed a Parse Server file URL.

Detection Strategies

Enumerate stored file metadata across cloud object storage and flag any Content-Type value that fails RFC 6838 parsing.
Inspect Parse Server file-upload logs for requests where the client-supplied Content-Type header lacks a valid subtype.
Scan file bodies for HTML or SVG markers when the recorded MIME type is not a recognized mime-package value.

Monitoring Recommendations

Alert on file downloads served with malformed media types from application storage buckets.
Monitor for anomalous session activity following user access to file URLs on the Parse Server domain.
Track upload endpoints for elevated volumes of files with unusual or missing extensions.

How to Mitigate CVE-2026-61448

Immediate Actions Required

Upgrade Parse Server to version 9.10.0-alpha.2 or 8.6.84, which enforce strict Content-Type validation.
Audit existing objects in S3, GCS, and Azure Blob Storage for malformed Content-Type metadata and remediate or delete affected files.
Rotate session tokens for users who may have accessed suspicious file URLs.

Patch Information

The Parse Server maintainers released fixes in versions 9.10.0-alpha.2 and 8.6.84. The patches reject uploads whose Content-Type is not a valid type/subtype media type and no longer preserve unrecognized values. Refer to the GitHub Security Advisory for release notes and commit references.

Workarounds

Switch to the default GridFS storage adapter, which is not affected by this issue.
Configure the storage bucket or CDN to override or strip client-supplied Content-Type headers and enforce a safe default such as application/octet-stream.
Serve user-uploaded files from a separate origin or sandboxed domain and set Content-Disposition: attachment and X-Content-Type-Options: nosniff on responses.

bash

# Configuration example: enforce nosniff and attachment disposition at the storage layer
# AWS S3 example using the CLI to set headers on existing objects
aws s3 cp s3://my-bucket/uploads/س3://my-bucket/uploads/ \
  --recursive \
  --metadata-directive REPLACE \
  --content-disposition "attachment" \
  --metadata x-content-type-options=nosniff