{"id":"EUVD-2026-42414","enisaUuid":"c8af41db-cc33-3a98-ac36-0bcbebef9c76","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.11 and 8.6.81, the default fileUpload.fileExtensions blocklist could be bypassed by uploading a file with a non-standard or compound extension and dangerous content type, allowing storage adapters such as S3 and GCS to serve attacker-supplied active content and enable stored cross-site scripting. This issue is fixed in versions 9.9.1-alpha.11 and 8.6.81.","datePublished":"Jul 8, 2026, 8:50:52 PM","dateUpdated":"Jul 9, 2026, 1:39:44 PM","baseScore":2.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-v8x7-r927-cc93\nhttps://github.com/parse-community/parse-server/pull/10505\nhttps://github.com/parse-community/parse-server/pull/10506\nhttps://github.com/parse-community/parse-server/commit/97c6a78d19f976ec756c1295f08a8fccab90799a\nhttps://github.com/parse-community/parse-server/commit/be12a60d65b6e140481882037fb896b1f951df50\nhttps://github.com/parse-community/parse-server/releases/tag/8.6.81\nhttps://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.11\n","aliases":"CVE-2026-55778\nGHSA-v8x7-r927-cc93\n","assigner":"GitHub_M","epss":0.55,"enisaIdProduct":[{"id":"7a46e207-c7b0-35a5-80cc-d87f92956081","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"\u003c 8.6.81"},{"id":"bd36f5f1-91f2-3df9-8bf9-5eee6469a0f4","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.0.0-alpha.1, \u003c 9.9.1-alpha.11"}],"enisaIdVendor":[{"id":"5b5b55d1-fbc2-3908-8904-1a37cd7c823f","vendor":{"name":"parse-community"}}],"enisaIdVulnerability":[{"id":"0c230453-2301-351a-ae92-de630b0c9c12","vulnerability":{"id":"CVE-2026-55778","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.11 and 8.6.81, the default fileUpload.fileExtensions blocklist could be bypassed by uploading a file with a non-standard or compound extension and dangerous content type, allowing storage adapters such as S3 and GCS to serve attacker-supplied active content and enable stored cross-site scripting. This issue is fixed in versions 9.9.1-alpha.11 and 8.6.81.","datePublished":"Jul 8, 2026, 8:50:52 PM","dateUpdated":"Jul 9, 2026, 1:39:44 PM","status":"PUBLISHED","baseScore":2.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-v8x7-r927-cc93\nhttps://github.com/parse-community/parse-server/pull/10505\nhttps://github.com/parse-community/parse-server/pull/10506\nhttps://github.com/parse-community/parse-server/commit/97c6a78d19f976ec756c1295f08a8fccab90799a\nhttps://github.com/parse-community/parse-server/commit/be12a60d65b6e140481882037fb896b1f951df50\nhttps://github.com/parse-community/parse-server/releases/tag/8.6.81\nhttps://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.11\n","enisa_id":"EUVD-2026-42414\n","assigner":"GitHub_M","epss":0.55,"dataProcessed":"Nov 7, 2026, 7:20:15 AM","vulnerabilityProduct":[{"id":"81ef3b8b-7607-3156-b779-cadb9926d93f","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"\u003c 8.6.81"},{"id":"c8d1cfcf-cbd2-3390-8225-75527db0ea4d","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.0.0-alpha.1, \u003c 9.9.1-alpha.11"}],"vulnerabilityVendor":[{"id":"eb2dbc5e-836a-342a-b16d-c86d0eb1d233","vendor":{"name":"parse-community"}}]}},{"id":"718ff25e-16a7-348c-b080-f5825ea947a1","vulnerability":{"id":"GHSA-v8x7-r927-cc93","description":"parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist","datePublished":"Jun 19, 2026, 7:36:36 PM","dateUpdated":"Jun 19, 2026, 7:36:36 PM","baseScore":0.0,"references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-v8x7-r927-cc93\nhttps://github.com/parse-community/parse-server/pull/10505\nhttps://github.com/parse-community/parse-server/pull/10506\nhttps://github.com/parse-community/parse-server\n","enisa_id":"EUVD-2026-42414\n","aliases":"CVE-2026-55778\nGHSA-v8x7-r927-cc93\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}