Executive brief
Parse Server is a backend framework that provides data storage and API services for mobile and web applications. The PagesRouter feature, which serves static files from a configured directory, contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files outside the intended pages directory. This could expose sensitive application data, configuration files, or other confidential information stored on the server.
Technical details
The vulnerability exists in the PagesRouter static file serving component, which performs an insufficient boundary check using string prefix comparison without enforcing directory separator enforcement (CWE-22). An attacker can exploit path traversal sequences to access sibling directories whose names begin with the same prefix as the configured pagesPath (e.g., accessing "pages-secret" when pagesPath is "pages"). The attack is unauthenticated and network-reachable, requiring only that the pages feature is enabled (pages.enableRouter: true) and a sibling directory with a matching name prefix exists. Patches are available in version 8.6.8 and 9.5.0-alpha.8 or later, which enforce proper directory separator boundaries in path validation.
Affected products
- Parse Community Parse Server < 8.6.8; >= 9.0.0 < 9.5.0-alpha.8
Timeline
- 2026-03-07: disclosed
- 2026-03-09: patched: Patch versions 8.6.8 and 9.5.0-alpha.8 released