CVE-2026-55778 Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist
Attackers can upload malicious files with non-standard extensions to trigger stored XSS, potentially executing arbitrary scripts in user browsers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55778?
CVE-2026-55778 is a low-severity cross-site scripting vulnerability in parse-community parse-server, published on 8 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.11 and 8.6.81, the default fileUpload.fileExtensions blocklist could be bypassed by uploading a file with a non-standard or compound extension and dangerous content type, allowing storage adapters such as S3 and GCS to serve attacker-supplied active content and enable stored cross-site scripting. This issue is fixed in versions 9.9.1-alpha.11 and 8.6.81.
Weakness: CWE-434
Which versions are affected by CVE-2026-55778?
5 open source packages ship an affected version, including parse-server and parse.
| Package | Affected | Fixed in |
|---|---|---|
parse-server npm | All versions | 8.6.81 |
parse-server npm | All versions | 8.6.81 |
parse-server npm | From 9.0.0 | 9.9.1-alpha.11 |
parse-server npm | From 9.0.0 | 9.9.1-alpha.11 |
parse Bitnami | All versions | 8.6.81, 9.9.1 |
How do I fix CVE-2026-55778?
Upgrade parse-server to a fixed version for your release line: 8.6.81 or 9.9.1-alpha.11.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-55778 being exploited?
There is no known exploitation of CVE-2026-55778 in the wild and no public exploit code.
Sources
Also known as BIT-parse-2026-55778, GHSA-v8x7-r927-cc93.