CVE-2026-35200 Parse Server has a file upload Content-Type override via extension mismatch
Attackers can upload files with mismatched extensions and Content-Types, potentially leading to code execution or bypassing security controls when served by compatible storage adapters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-35200?
CVE-2026-35200 is a low-severity vulnerability in Parseplatform Parse-Server, published on 6 Apr 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73 and 9.7.1-alpha.4, a file can be uploaded with a filename extension that passes the file extension allowlist (e.g., .txt) but with a Content-Type header that differs from the extension (e.g., text/html). The Content-Type is passed to the storage adapter without consistency validation. Storage adapters that store and serve the provided Content-Type (such as S3 or GCS) serve the file with the mismatched Content-Type. The default GridFS adapter is not affected because it derives Content-Type from the filename at serving time. This vulnerability is fixed in 8.6.73 and 9.7.1-alpha.4.
Weakness: CWE-436
Which versions are affected by CVE-2026-35200?
5 open source packages ship an affected version, including parse-server and parse. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
parse-server npm | All versions | 8.6.73 |
parse-server npm | All versions | 8.6.73 |
parse-server npm | From 9.0.0 | 9.7.1-alpha.4 |
parse-server npm | From 9.0.0 | 9.7.1-alpha.4 |
parse Bitnami | All versions | 8.6.73, 9.7.1 |
Products include Parseplatform Parse-Server.
How do I fix CVE-2026-35200?
Upgrade parse-server to a fixed version for your release line: 8.6.73 or 9.7.1-alpha.4.
Is CVE-2026-35200 being exploited?
There is no known exploitation of CVE-2026-35200 in the wild and no public exploit code.
Other vulnerabilities in Parseplatform Parse-Server
- CVE-2026-30966 Parse Server role escalation and CLP bypass via direct `_Join` table write
- CVE-2024-27298 Parse Server literalizeRegexPart SQL Injection
- CVE-2022-24760 Command Injection in Parse server
- CVE-2026-30965 Parse Server session token exfiltration via `redirectClassNameForKey` query parameter
- CVE-2023-36475 Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
Sources
Also known as BIT-parse-2026-35200, GHSA-vr5f-2r24-w5hc.