CVE-2026-35200 describes an interpretation conflict vulnerability in parse-community's parse-server where files uploaded with an allowed filename extension but a differing Content-Type header are accepted. The Content-Type header is forwarded to storage adapters without validation, causing adapters such as S3 or GCS to serve files with mismatched Content-Type headers. This can lead to inconsistent handling of files by clients. The vulnerability affects parse-server versions prior to 8.6.73 and 9.7.1-alpha.4. The default GridFS adapter is not vulnerable because it determines Content-Type based on the filename at serving time. The issue has been fixed in the specified versions.

The vulnerability may cause files to be served with a Content-Type header that does not match their filename extension, potentially leading to interpretation conflicts on the client side. This could affect how browsers or other clients handle the file content, but no direct code execution or data breach is indicated. The CVSS score of 2.1 and low severity rating reflect the limited impact. No known exploits are reported in the wild.

A fix is available in parse-server versions 8.6.73 and 9.7.1-alpha.4. Users should upgrade to these or later versions to resolve the issue. Since this is a cloud service, the vendor manages remediation for hosted instances; users should verify with their service provider that the patch has been applied. No additional mitigation actions are specified or required.