File Upload Vulnerability in Parse Server by Parse Community

CVE-2026-35200

What is CVE-2026-35200?

Parse Server, an open-source backend platform that runs on Node.js, contains a vulnerability that allows for the upload of files with extensions that bypass the allowed list. Specifically, prior to versions 8.6.73 and 9.7.1-alpha.4, files can be uploaded with mismatched Content-Type headers, enabling potential security risks when these files are served by storage adapters like S3 or GCS. This inconsistency in Content-Type validation could lead to exploitation, as files may be served with a Content-Type that does not match their extension. Users are advised to upgrade to the fixed versions to enhance the security of their deployment.

References