The vulnerability exists in Parse Server versions prior to 8.6.95 and 9.0.0 prior to 9.10.2-alpha.3. The server does not resolve file references lacking a URL before passing them to Cloud Code triggers and LiveQuery, leading to an uncaught exception that terminates the process. An attacker who can write to a class whose Cloud Code save, find, or delete triggers or LiveQuery is enabled can induce a crash, thereby denying service and disrupting subsequent requests. The flaw is an example of inconsistent handling of missing URLs, reflected by CWE-248.

Affected systems include Parse Server from parse-community as packaged in the parse platform. Versions before 8.6.95 in the 8.x line and before 9.10.2-alpha.3 in the 9.x line are vulnerable. Systems running these versions are impacted.

The CVSS score of 8.2 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw when they possess write capabilities to Cloud Code triggers or LiveQuery, including unauthenticated users if public write access or sign-up is allowed. By creating or modifying trigger logic to reference files without URLs, an attacker can trigger the crash and deny service.