CVE-2026-53724

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.79 Parse Server versions prior to 9.9.1

Description The default file upload extension blocklist can be bypassed by appending a trailing dot to a filename with an extension that would normally be blocked. This causes the extension parser to extract an empty string, bypassing the blocklist check and allowing an attacker-controlled Content-Type to be forwarded to the storage adapter. Storage adapters that persist and serve the provided Content-Type, such as S3 or GCS, may serve the file with an active type like image/svg+xml, leading to stored Cross-Site Scripting (XSS), which is a vulnerability where malicious scripts are permanently stored on the target server and executed in the victim's browser when they open the file URL.

Recommendations Update to version 8.6.79 or later. Update to version 9.9.1 or later.