Parse Server allowed attackers to inject malicious files that could be served with an active Content‑Type such as image/svg+xml. By appending a trailing dot to a filename, the extension parser extracted an empty string, bypassing the default blocklist. The storage adapter forwarded the attacker‑controlled Content‑Type to the response headers, allowing tricked users to open the file URL and trigger client‑side execution of malicious scripts (stored cross‑site scripting). The weakness is a combination of improper input validation and inadequate file type checking, corresponding to CWE‑434 and CWE‑79.

The impact covers deployments of parse-community:parse‑server released before version 8.6.79 and before 9.9.1‑alpha.4. These older releases lack the file‑extension blocklist fix and can be reached on any infrastructure running Node.js that hosts Parse Server.

The CVSS score of 2.1 indicates low severity, and the EPSS score of less than 1% suggests a very small chance of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to upload a file through the public API or an authenticated file upload endpoint, manipulate the filename to include a trailing dot, and then persuade a victim to open or embed the published file URL.