Parse Server allows uploads of files whose filename extension passes the server’s whitelist but whose Content‑Type header differs. The Content‑Type supplied by the client is forwarded to the storage adapter without validation. Storage adapters that honor the provided MIME type, like S3 or GCS, serve the file with the mismatched type. The default GridFS adapter derives the type when the file is retrieved, so it is not affected. Based on the description, it is inferred that an attacker could upload a file that looks like a harmless text file but is served as HTML or JavaScript, potentially enabling client‑side execution or other content‑type based attacks. The flaw does not provide server‑side code execution.

Parse Server from the parse‑community project is affected. Versions older than 8.6.73 and older than 9.7.1‑alpha.4 are vulnerable. The default GridFS adapter is safe because it determines the MIME type on download, but adapters that store and serve the client‑supplied MIME type, such as Amazon S3 or Google Cloud Storage, are at risk.

CVSS score of 2.1 indicates a low severity impact. EPSS score under 1% suggests low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must be able to upload a file to the Parse Server instance and use a storage adapter that echoes the uploaded Content‑Type header. Under those conditions, the attacker can cause the file to be served with a different MIME type, which might provide a vector for cross‑site scripting or other content‑type confusion attacks.