CVE-2026-53724: parse-server Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7wqv-xjf3-x35v",
  "modified" : "2026-06-19T19:35:11Z",
  "published" : "2026-06-19T19:35:11Z",
  "aliases" : [ "CVE-2026-53724" ],
  "summary" : "parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist",
  "details" : "### Impact\n\nThe default file upload extension blocklist can be bypassed by appending a trailing dot to a filename whose extension would otherwise be blocked (e.g. `poc.svg.`). The trailing dot causes the extension parser to extract an empty string, which short-circuits the blocklist check, and the attacker-controlled Content-Type is forwarded to the storage adapter unchanged. Storage adapters that persist and serve the provided Content-Type (such as S3 or GCS) then serve the file with an active type such as `image/svg+xml`, enabling stored XSS when a victim opens the file URL. The default GridFS adapter is not affected because it sets `X-Content-Type-Options: nosniff` on responses.\n\n### Patches\n\nA filename ending in a dot is now treated as extensionless. When the parser produces an empty extension, the request handler falls back to validating the Content-Type subtype against the configured extension blocklist, matching the path that already catches truly extensionless uploads with a dangerous Content-Type. This is a follow-up to the previous fix [GHSA-vr5f-2r24-w5hc](https://github.com/parse-community/parse-server/security/advisories/GHSA-vr5f-2r24-w5hc).\n\n### Workarounds\n\nConfigure the storage adapter or CDN to derive Content-Type from the filename extension instead of using the stored Content-Type, or replace the default blocklist with an explicit allowlist of needed file extensions.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "parse-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.0.0"
      }, {
        "fixed" : "9.9.1-alpha.4"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "parse-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "8.6.79"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 8.6.78"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/parse-community/parse-server/security/advisories/GHSA-7wqv-xjf3-x35v"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-53724"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/parse-community/parse-server/pull/10489"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/parse-community/parse-server/pull/10490"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/parse-community/parse-server"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-434", "CWE-79" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-19T19:35:11Z",
    "nvd_published_at" : "2026-06-12T19:16:30Z"
  }
}