Parse Server allows an attacker to upload a file with a file extension or MIME type that is not blocked by the default fileUpload.fileExtensions option. The file can contain malicious code such as JavaScript inside an SVG or XHTML payload. When accessed via its URL, the browser renders the file and executes the embedded script in the context of the Parse Server domain. This stored XSS vulnerability can be used to steal session tokens, redirect users, or perform actions on behalf of other users.

All Parse Server releases prior to v9.6.0‑alpha.4 and v8.6.30 are affected. The vulnerability stems from the fileUpload.fileExtensions setting that does not filter the following types by default: .svgz, .xht, .xml, .xsl, .xslt, and the content types application/xhtml+xml and application/xslt+xml for uploads without an extension. Uploads of .html, .htm, .shtml, .xhtml, and .svg files were already blocked, so the exploit requires one of the other allowed types.

The CVSS v3 score of 6.3 indicates a medium severity. The EPSS probability is below 1 %, which suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote access to the file‑upload endpoint and the ability to access the uploaded file via its URL, typically by an authenticated or anonymous attacker who can upload a crafted file. Once the file is accessed, the stored XSS effect is achieved.