Parse Server 9.0.0 Stored XSS via malformed Content-Type

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-61448 · Microsoft / collected KEV context

EUVD-2026-43183

GHSA-p6c5-mjgj-m4rm

GHSA-r899-h629-j84r

BIT-parse-2026-61448

cve-program · CVE-2026-61448

• https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r
• https://www.vulncheck.com/advisories/parse-server-stored-xss-via-malformed-content-type

euvd · EUVD-2026-43183

• https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r
• https://www.vulncheck.com/advisories/parse-server-stored-xss-via-malformed-content-type

nvd · CVE-2026-61448

• https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r
• https://www.vulncheck.com/advisories/parse-server-stored-xss-via-malformed-content-type

osv · GHSA-p6c5-mjgj-m4rm

• https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r
• https://nvd.nist.gov/vuln/detail/CVE-2026-61448
• https://www.vulncheck.com/advisories/parse-server-stored-xss-via-malformed-content-type

osv · GHSA-r899-h629-j84r

• https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r
• https://nvd.nist.gov/vuln/detail/CVE-2026-61448
• https://github.com/parse-community/parse-server
• https://www.vulncheck.com/advisories/parse-server-stored-xss-via-malformed-content-type

• Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-s… · Advisory content revised · 2 Nov 2026
• Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist · Newly collected advisory · 29 Oct 2026