Parse Server allows user file uploads and validates the file's extension against a denylist. Prior to version 9.6.0-alpha.15 (and 8.6.41), the parser failed to remove MIME parameters from the Content-Type header, letting an attacker append values such as ';charset=utf-8' to the header. This bypass caused the extension check to miss the real file type, allowing active content such as JavaScript‑bearing XML files to be stored and served over the application's domain. The exposed stored XSS can compromise session cookies, user credentials, or other data accessible via browser local storage. This flaw is a classic Stored Cross‑Site Scripting issue (CWE‑79).

The affected product is parse-community's Parse Server. All versions prior to 9.6.0-alpha.15 and 8.6.41 are vulnerable. The CPE entries identified include parseplatform:parse-server:%* across all supported Node.js runtime environments.

The CVSS score of 8.3 indicates high severity, while the EPSS score of below 1% suggests a low probability of exploitation in the near term. However, because the flaw is a stored XSS that can be triggered by any user with file‑upload permissions, the risk remains significant. The vulnerability is not currently listed in the CISA KEV catalog. Attackers can exploit the flaw by uploading a crafted file with an obfuscated MIME type that allows the server to serve malicious content under the legitimate domain, enabling cross‑site script execution in victims' browsers.