8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32728

CVE-2026-32728: Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.15 and 8.6.41, an attacker who is allowed to upload files can bypass the file extension filter by appending a MIME parameter (e.g. ;charset=utf-8) to the Content-Type header. This causes the extension validation to fail matching against the blocklist, allowing active content to be stored and served under the application's domain. In addition, certain XML-based file extensions that can render scripts in web browsers are not included in the default blocklist. This can lead to stored XSS attacks, compromising session tokens, user credentials, or other sensitive data accessible via the browser's local storage. The fix in versions 9.6.0-alpha.15 and 8.6.41 strips MIME parameters from the Content-Type header before validating the file extension against the blocklist. The default blocklist has also been extended to include additional XML-based extensions (xsd, rng, rdf, rdf+xml, owl, mathml, mathml+xml) that can render active content in web browsers. Note that the fileUpload.fileExtensions option is intended to be configured as an allowlist of file extensions that are valid for a specific application, not as a denylist. The default denylist is provided only as a basic default that covers most common problematic extensions. It is not intended to be an exhaustive list of all potentially dangerous extensions. Developers should not rely on the default value, as new extensions that can render active content in browsers might emerge in the future. As a workaround, configure the fileUpload.fileExtensions option to use an allowlist of only the file extensions that your application needs, rather than relying on the default blocklist.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32728

CVE-2026-32728:

8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.6.0-alpha.15	9.6.0-alpha.15
parse-server	npm	< 8.6.41	8.6.41

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows stored Cross-Site Scripting (XSS) by bypassing file upload filters in Parse Server. The core of the issue lies in how the server processes the Content-Type header during file uploads. The advisory points out two related problems: a filter bypass using MIME parameters and an incomplete blocklist of dangerous file extensions.

The analysis of the provided patches, specifically commits 4f53ab3cad5502a51a509d53f999e00ff7217b8d and c7599c577a02b97eb5e76d4e20517b0283ae73c8, reveals that the main logic flaw is located in the handleCreateFile method within the FilesRouter class in src/Routers/FilesRouter.js.

The vulnerable code failed to strip MIME parameters from the Content-Type string before validating the file extension. For example, a Content-Type of application/xml;charset=utf-8 would result in the extension being incorrectly identified as xml;charset=utf-8, which would not be found in the blocklist of dangerous extensions. The patch corrects this by splitting the content type string at the semicolon, ensuring that the correct extension (xml in this case) is extracted and validated.

Therefore, the FilesRouter.handleCreateFile function is the direct location of the vulnerability. When this vulnerability is exploited, this function would be processing the malformed Content-Type header and would appear in any runtime profile or stack trace. The patches also update the default blocklist in configuration files (src/Options/Definitions.js), but the exploitable processing logic is contained within handleCreateFile.

Vulnerable functions

FilesRouter.handleCreateFile

src/Routers/FilesRouter.js

The `handleCreateFile` function is responsible for processing file uploads. It determines the file extension from the `Content-Type` header. The vulnerability lies in the improper parsing of this header. Before the patch, the code did not correctly handle MIME type parameters (e.g., `;charset=utf-8`). An attacker could append such a parameter to a blocked content type (like `application/xml`) to bypass the extension validation. The function would extract an incorrect extension (e.g., `xml;charset=utf-8`) which would not match the blocklist, allowing the upload of a malicious file leading to a stored XSS.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.