Parse Server suffers from a stored cross‑site scripting flaw that is triggered when an uploaded file’s extension is not recognized by the mime package. The server then keeps the client‑supplied Content‑Type header. If that header is malformed—such as ‘image’, ‘image/’, or ‘image//svg+xml’—the file bypasses the server’s blocklist and the invalid type is stored unchanged. When a storage adapter serves that MIME type, a browser that cannot parse the malformed value falls back to MIME sniffing. If the file body starts with HTML, the browser renders it and any embedded script runs in the URL. The weakness is an uncontrolled input leading to theft of confidentiality, integrity, and availability on the client side (CWE‑434).

The vulnerable product is Parse Server from the Parse Community. Affected releases are 9.0.0 through 9.9.999 (less than 9.10.0‑alpha.2) and 8.6.83 or earlier. The default GridFS storage adapter is explicitly not affected the stored MIME type, such as Amazon S3, Google Cloud Storage, or Azure Blob Storage.

The CVSS score of 2.1 indicates a low severity stored XSS very low probability of exploitation in the wild, and the vulnerability is not catalogued in CISA’s KEV. Exploitation requires a malicious file upload to a vulnerable storage adapter that retains the supplied Content‑Type. The attack succeeds when a client browser processes an HTML the MIME type was invalid, allowing script execution in the site’s context. Given the low score, the overall risk is low, but any user who views a compromised file can suffer client‑side code execution.