CVE-2026-55778: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-a…
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.11 and 8.6.81, the default fileUpload.fileExtensions blocklist could be bypassed by uploading a file with a non-standard or compound extension and dangerous content type, allowing storage adapters such as S3 and GCS to serve attacker-supplied active content and enable stored cross-site scripting. This issue is fixed in versions 9.9.1-alpha.11 and 8.6.81.
- Published by source
- 2026-07-08
- First seen by Reality Radar
- 2026-10-25
- Last verified
- 2026-10-25
What the official notice says
Risk: CVSS 2.1
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-07-08
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #1677 | new | 2026-10-25 | 4a246d9f8510…3f5090 | 30a656c3369a…1b8067 |
Chain head: #1697 83c542f07eed…822c88