Is CVE-2026-109301 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109301 being exploited in the wild.

How severe is CVE-2026-109301?

Medium severity, with a CVSS score of 5.9, published 12 October 2026.

Which products and versions are affected?

Parse Community Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3.

How is CVE-2026-109301 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-109301?

Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109301: Parse Server unhandled file reference exception in Cloud Code

CVE-2026-109301 · Severity: medium · CVSS 5.9 · Published 2026-10-12

Parse Server is a backend-as-a-service platform that manages cloud applications and data. An attacker can crash the Parse Server process by submitting data containing file references without URLs to classes that have Cloud Code triggers or LiveQuery enabled. If public write access is permitted or user sign-up is available, no authentication is needed to mount this attack, resulting in complete service outages.

Technologies: Parse Community Parse Server. Vendors: Parse Community.

Quick answers

Is CVE-2026-109301 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109301 being exploited in the wild.
How severe is CVE-2026-109301?: Medium severity, with a CVSS score of 5.9, published 12 October 2026.
Which products and versions are affected?: Parse Community Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3.
Is there a fix for CVE-2026-109301?: Yes: fixed in Parse Server 8.6.95, 9.10.2-alpha.3. Until then: Add middleware before Parse Server that rejects write requests with objects containing __type set to File that lack a URL or have an invalid name field. Note that this also rejects legitimate requests that reference existing files by name only.</anigation> <parameter name="timeline">[{"kind": "advisory", "at": "2026-09-25", "note": "GitHub security advisory GHSA-gpr6-gr9g-pfw6 published"}, {"kind": "disclosed", "at": "2026-10-12"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109301 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-109301?: Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Parse Server 8.6.95, 9.10.2-alpha.3

Add middleware before Parse Server that rejects write requests with objects containing __type set to File that lack a URL or have an invalid name field. Note that this also rejects legitimate requests that reference existing files by name only.</anigation> <parameter name="timeline">[{"kind": "advisory", "at": "2026-09-25", "note": "GitHub security advisory GHSA-gpr6-gr9g-pfw6 published"}, {"kind": "disclosed", "at": "2026-10-12"}]

Technical details

The vulnerability is an uncaught exception (CWE-248) that occurs when file references lacking a URL are passed to Cloud Code save/find/delete triggers or LiveQuery without prior resolution. An attacker with write access to an affected class—including unauthenticated users on publicly writable classes—can craft malicious objects with unresolved file pointers to trigger a process-terminating exception. Additionally, nested file references without URLs can be stored, causing subsequent trigger or LiveQuery operations on those objects to fail.

Affected products

Parse Community Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.