TI-2026-27353 Aliases CVE-2026-35200 GHSA-vr5f-2r24-w5hc

Parse Server has a file upload Content-Type override via extension mismatch

LOW 10CWE-436Published 2026-04-06 · Updated 2026-04-07

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73 and 9.7.1-alpha.4, a file can be uploaded with a filename extension that passes the file extension allowlist (e.g., .txt) but with a Content-Type header that differs from the extension (e.g., text/html). The Content-Type is passed to the storage adapter without consistency validation. Storage adapters that store and serve the provided Content-Type (such as S3 or GCS) serve the file with the mismatched Content-Type. The default GridFS adapter is not affected because it derives Content-Type from the filename at serving time. This vulnerability is fixed in 8.6.73 and 9.7.1-alpha.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00168 6th percentileScored 2026-11-07

Fix Fixed parse-server (parse-community): 9.7.1-alpha.4, 8.6.73parse-server (npm): 9.7.1-alpha.4, 8.6.73

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
parse-community	parse-server	9.0.0 to before 9.7.1-alpha.4; before 8.6.73	9.7.1-alpha.4, 8.6.73	Patch available	CNA
—	parse-server (npm)	9.0.0 to before 9.7.1-alpha.4	9.7.1-alpha.4	Patch available	GHSA-vr5f-2r24-w5hc
—	parse-server (npm)	before 8.6.73	8.6.73	Patch available	GHSA-vr5f-2r24-w5hc

parse-server Vendorparse-community Affected 9.0.0 to before 9.7.1-alpha.4; before 8.6.73 Fixed in 9.7.1-alpha.4, 8.6.73 Patch available CNA
parse-server (npm) Vendor— Affected 9.0.0 to before 9.7.1-alpha.4 Fixed in 9.7.1-alpha.4 Patch available GHSA-vr5f-2r24-w5hc
parse-server (npm) Vendor— Affected before 8.6.73 Fixed in 8.6.73 Patch available GHSA-vr5f-2r24-w5hc

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:parseplatform:parse-server::::::node.js::*	before 8.6.73; 9.0.0 to before 9.7.1	Vulnerable	parse-community
cpe:2.3:a:parseplatform:parse-server:9.7.1:alpha1::::node.js::*	9.7.1 alpha1	Vulnerable	parse-community
cpe:2.3:a:parseplatform:parse-server:9.7.1:alpha2::::node.js::*	9.7.1 alpha2	Vulnerable	parse-community
cpe:2.3:a:parseplatform:parse-server:9.7.1:alpha3::::node.js::*	9.7.1 alpha3	Vulnerable	parse-community

cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* Versions before 8.6.73; 9.0.0 to before 9.7.1 Vulnerable ·parse-community
cpe:2.3:a:parseplatform:parse-server:9.7.1:alpha1:*:*:*:node.js:*:* Versions 9.7.1 alpha1 Vulnerable ·parse-community
cpe:2.3:a:parseplatform:parse-server:9.7.1:alpha2:*:*:*:node.js:*:* Versions 9.7.1 alpha2 Vulnerable ·parse-community
cpe:2.3:a:parseplatform:parse-server:9.7.1:alpha3:*:*:*:node.js:*:* Versions 9.7.1 alpha3 Vulnerable ·parse-community

Remediation

Fix · CNA parse-server (parse-community) Fixed in 9.7.1-alpha.4, 8.6.73
Fix · GHSA-vr5f-2r24-w5hc parse-server (npm) Fixed in 9.7.1-alpha.4 Advisory →
Fix · GHSA-vr5f-2r24-w5hc parse-server (npm) Fixed in 8.6.73 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-35200
2026-10-03 Alias added: GHSA-vr5f-2r24-w5hc

References

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-35200

Other 1

https://github.com/parse-community/parse-server

TI-2022-08574 Command Injection in Parse server CVSS 3.1CRITICAL 10.0
TI-2024-18136 Parse Server literalizeRegexPart SQL Injection CVSS 3.1CRITICAL 10.0
TI-2022-18768 Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser CVSS 3.1CRITICAL 9.8
TI-2024-31550 Parse Server's custom object ID allows to acquire role privileges CVSS 3.1HIGH 8.1
TI-2023-18316 Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution CVSS 3.1CRITICAL 9.8
TI-2026-23790 Parse Server session token exfiltration via `redirectClassNameForKey` query parameter CVSS 4.0CRITICAL 9.9

See all 101 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences