Executive brief
Parse Server is a backend-as-a-service platform that handles file uploads for applications. An attacker can upload files with dangerous extensions (like .svgz, .xsl, .xml) that contain malicious JavaScript code. When users access these files, the JavaScript executes in the browser within the Parse Server domain, allowing attackers to steal login tokens, manipulate user sessions, or perform unauthorized actions on behalf of legitimate users.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in Parse Server's file upload handling. The root cause is incomplete default filtering of file extensions and content types—specifically .svgz, .xht, .xml, .xsl, .xslt, and application/xhtml+xml / application/xslt+xml content types were not blocked by default, even though they can render as HTML when accessed via HTTP. An unauthenticated attacker can upload such a file and have it stored on the server; when any user accesses the file URL in a browser, the embedded malicious script executes in the context of the Parse Server domain (not a separate domain), enabling session hijacking or privilege escalation. Fixes are available in Parse Server 8.6.30, 9.6.0-alpha.4 and later; alternatively, administrators can manually configure fileUpload.fileExtensions to block these file types.
Affected products
- Parse Community Parse Server before 8.6.30 and before 9.6.0-alpha.4 (all versions before 8.6.30; versions >= 9.0.0 and < 9.6.0-alpha.4)
Timeline
- 2026-03-11: disclosed
- 2026-03-11: patched: Fixed in Parse Server 8.6.30 and 9.6.0-alpha.4