6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30848

CVE-2026-30848: Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.8 and 9.5.0-alpha.8, the PagesRouter static file serving route is vulnerable to a path traversal attack that allows unauthenticated reading of files outside the configured pagesPath directory. The boundary check uses a string prefix comparison without enforcing a directory separator boundary. An attacker can use path traversal sequences to access files in sibling directories whose names share the same prefix as the pages directory (e.g. pages-secret starts with pages). This issue has been patched in versions 8.6.8 and 9.5.0-alpha.8.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30848

CVE-2026-30848:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	< 8.6.8	8.6.8
parse-server	npm	>= 9.0.0-alpha.1, < 9.5.0-alpha.8	9.5.0-alpha.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the PagesRouter class, specifically within the method that handles GET requests for static files. By analyzing the provided patches from the pull requests, I identified the exact code change that mitigates the vulnerability. Both commits, 89b27fee8f8843f4c781d01d886ae681ed67a3ba and d2b1de36f8aa560c9be5705452294e58caeafe35, modify the file src/Routers/PagesRouter.js. The change replaces a weak startsWith check with a stricter one that includes a path separator (path.sep). This change is located within the handleGET method of the PagesRouter class. The vulnerability description confirms that the issue is a path traversal in the PagesRouter's static file serving route. Therefore, the PagesRouter.handleGET function is the vulnerable function that would appear in a runtime profile during exploitation.

Vulnerable functions

PagesRouter.handleGET

src/Routers/PagesRouter.js

The `handleGET` method in the `PagesRouter` class is responsible for serving static files. It performs a check to ensure that the requested file path is within the configured `pagesPath` directory. The original implementation used `normalizedPath.startsWith(this.pagesPath)`, which is an insufficient check for path traversal. An attacker could request a URL with path traversal characters (e.g., `..%2f`) to access a sibling directory whose name has the same prefix as the `pagesPath` directory (e.g., `pages` and `pages-secret`). The patch fixes this by ensuring the path starts with the `pagesPath` followed by a path separator, thus preventing access to files outside the intended directory.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.