Parse Server suffers from a stored cross‑site scripting flaw that is triggered when an uploaded file’s extension is not recognized by the mime package. The server then keeps the client‑supplied Content‑Type header. If that header is malformed—such as ‘image’, ‘image/’, or ‘image//svg+xml’—the file bypasses the server’s blocklist and the invalid type is stored unchanged. When a storage adapter serves that MIME type, a browser that cannot parse the malformed value falls back to MIME sniffing. If the file body starts with HTML, the browser renders it and any embedded script runs in the URL. The weakness is an uncontrolled input leading to theft of confidentiality, integrity, and availability on the client side (CWE‑434).

The vulnerable product is Parse Server from the Parse Community. Affected releases are 9.0.0 through 9.9.999 (less than 9.10.0‑alpha.2) and 8.6.83 or earlier. The default GridFS storage adapter is explicitly not affected; storage adapters that persist and serve the uploaded Content‑Type such as Amazon S3, Google Cloud Storage, or Azure Blob Storage are susceptible.

The CVSS score of 2.1 classifies the issue as low‑severity stored XSS, and the EPSS rated less than 1% indicates that exploitation is unlikely in the wild. Exploitation requires an attacker to upload a file with a malformed Content‑Type to a storage adapter that preserves that header, such as Amazon S3, Google Cloud or Azure Blob, and the attacker must also persuade a victim to access the file. Because the vulnerability is not listed in CISA’s KEV catalog, there is no evidence of current active exploitation.