Log in / Sign up

Vulnerability details

CVE-2026-30948

parse-community parse-server

Parse Server has stored cross-site scripting (XSS) via SVG file upload

CVSS 4.0
8.3High

Official description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.4 and 8.6.17, a stored cross-site scripting (XSS) vulnerability allows any authenticated user to upload an SVG file containing JavaScript. The file is served inline with Content-Type: image/svg+xml and without protective headers, causing the browser to execute embedded scripts in the Parse Server origin. This can be exploited to steal session tokens from localStorage and achieve account takeover. The default fileExtensions option blocks HTML file extensions but does not block SVG, which is a well-known XSS vector. All Parse Server deployments where file upload is enabled for authenticated users (the default) are affected. This vulnerability is fixed in 9.5.2-alpha.4 and 8.6.17.

CVSS scores

ScoreVersionSourceVector
8.3High 4.0 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

Affected products

VendorProductVersionsSource
parse-community parse-server < 8.6.17 CVEProject cvelistV5 (CNA)
parse-community parse-server >= 9.0.0 < 9.5.2-alpha.4 CVEProject cvelistV5 (CNA)

References and advisories

3
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-03-10
Last updated
2026-03-11
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

0.24%
Probability of exploitation in 30 days
15.7%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
None
Technical impact
Partial

Weaknesses (CWE)

  • CWE-79
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')