8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30948

CVE-2026-30948: Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload

Impact

A stored cross-site scripting (XSS) vulnerability allows any authenticated user to upload an SVG file containing JavaScript. The file is served inline with Content-Type: image/svg+xml and without protective headers, causing the browser to execute embedded scripts in the Parse Server origin. This can be exploited to steal session tokens from localStorage and achieve account takeover.

The default fileExtensions option blocks HTML file extensions but does not block SVG, which is a well-known XSS vector. All Parse Server deployments where file upload is enabled for authenticated users (the default) are affected.

Patches

The fix adds svg (case-insensitive) to the default file extension denylist. The default regex changes from ^(?![xXsS]?[hH][tT][mM][lL]?$) to ^(?!([xXsS]?[hH][tT][mM][lL]?|[sS][vV][gG])$).

Workarounds

Configure the fileExtensions option to explicitly block SVG uploads:

{
  fileUpload: {
    fileExtensions: ['^(?!([xXsS]?[hH][tT][mM][lL]?|[sS][vV][gG])$)']
  }
}

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-hcj7-6gxh-24ww
Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.4
Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.17

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30948

CVE-2026-30948:

8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.5.2-alpha.4	9.5.2-alpha.4
parse-server	npm	< 8.6.17	8.6.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored XSS caused by uploading SVG files. The provided patch updates the default regular expression for the fileExtensions option in src/Options/Definitions.js to block SVG files. This indicates that the vulnerability lies not in a specific code change within a function, but in the default configuration that is used by the file upload handling logic. The tests associated with the patch make POST requests to the /1/files/:fileName endpoint. In Parse Server, such endpoints are handled by router classes located in the src/Routers directory. It is highly likely that a FilesRouter.js file exists and contains the logic for handling file uploads. A method within this router, likely named handleCreate, would be responsible for processing the file upload, which includes validating the file extension against the fileExtensions configuration. Therefore, FilesRouter.handleCreate is identified as the vulnerable function, as it is the function that processes the potentially malicious input using the insecure default configuration. The confidence is medium because the file src/Routers/FilesRouter.js was not directly analyzed from the provided context, but its existence and the function's name are inferred from the test files and the overall structure of the Parse Server application.

Vulnerable functions

FilesRouter.handleCreate

src/Routers/FilesRouter.js

This function handles file uploads and uses the `fileExtensions` configuration option to validate the file extension. The default value for this option was insecure as it did not block SVG files, leading to a stored XSS vulnerability. The function itself is not flawed, but it's the entry point for the vulnerable operation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.