CVE-2026-53724 Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist
Attackers can bypass file upload restrictions to store malicious files that trigger stored XSS when served with active content types.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-53724?
CVE-2026-53724 is a low-severity cross-site scripting vulnerability in parse-community parse-server, published on 12 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.79 and 9.9.1-alpha.4, the default file upload extension blocklist can be bypassed by appending a trailing dot to a filename whose extension would otherwise be blocked (e.g. poc.svg.). The trailing dot causes the extension parser to extract an empty string, which short-circuits the blocklist check, and the attacker-controlled Content-Type is forwarded to the storage adapter unchanged. Storage adapters that persist and serve the provided Content-Type (such as S3 or GCS) then serve the file with an active type such as image/svg+xml, enabling stored XSS when a victim opens the file URL. The default GridFS adapter is not affected because it sets X-Content-Type-Options: nosniff on responses. This issue has been patched in versions 8.6.79 and 9.9.1-alpha.4.
Which versions are affected by CVE-2026-53724?
5 open source packages ship an affected version, including parse-server and parse.
| Package | Affected | Fixed in |
|---|---|---|
parse-server npm | All versions | 8.6.79 |
parse-server npm | All versions | 8.6.79 |
parse-server npm | From 9.0.0 | 9.9.1-alpha.4 |
parse-server npm | From 9.0.0 | 9.9.1-alpha.4 |
parse Bitnami | All versions | 8.6.79, 9.9.1 |
How do I fix CVE-2026-53724?
Upgrade parse-server to a fixed version for your release line: 8.6.79 or 9.9.1-alpha.4.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-53724 being exploited?
There is no known exploitation of CVE-2026-53724 in the wild and no public exploit code.
Sources
Also known as BIT-parse-2026-53724, GHSA-7wqv-xjf3-x35v.