CVE-2026-35200: CWE-436: Interpretation Conflict in parse-community parse-server
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73 and 9.7.1, a file can be uploaded with a filename extension that passes the file extension allowlist (e.g., .txt) but with a Content-Type header that differs from the extension (e.g., text/html). The Content-Type is passed to the storage adapter without consistency validation. Storage adapters that store and serve the provided Content-Type (such as S3 or GCS) serve the file with the mismatched Content-Type. The default GridFS adapter is not affected because it derives Content-Type from the filename at serving time. This vulnerability is fixed in 8.6.73 and 9.7.1.
AI Analysis
Technical Summary
CVE-2026-35200 describes an interpretation conflict vulnerability (CWE-436) in parse-server where uploaded files can have a filename extension allowed by the system but a differing Content-Type header. The Content-Type header is passed directly to storage adapters without validation, causing adapters such as Amazon S3 or Google Cloud Storage to serve files with mismatched Content-Type headers. This can lead to incorrect content handling by clients. The vulnerability affects parse-server versions prior to 8.6.73 and 9.7.1-alpha.4. The default GridFS storage adapter is not vulnerable because it determines Content-Type based on the filename at serving time. The vulnerability has a low CVSS score of 2.1 and no known exploits in the wild.
Potential Impact
The impact is limited to files being served with an incorrect Content-Type header when using certain storage adapters (e.g., S3, GCS). This may cause clients to misinterpret the file content type, potentially leading to minor security or usability issues. There is no indication of direct code execution, privilege escalation, or data breach from this vulnerability. The default GridFS adapter is not affected.
Mitigation Recommendations
A fix is available in parse-server versions 8.6.73 and 9.7.1-alpha.4. Users should upgrade to these or later versions to resolve the issue. Since this is a cloud service, the vendor manages remediation for hosted services; users should verify with the vendor if using a managed parse-server instance. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-35200: CWE-436: Interpretation Conflict in parse-community parse-server
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73 and 9.7.1, a file can be uploaded with a filename extension that passes the file extension allowlist (e.g., .txt) but with a Content-Type header that differs from the extension (e.g., text/html). The Content-Type is passed to the storage adapter without consistency validation. Storage adapters that store and serve the provided Content-Type (such as S3 or GCS) serve the file with the mismatched Content-Type. The default GridFS adapter is not affected because it derives Content-Type from the filename at serving time. This vulnerability is fixed in 8.6.73 and 9.7.1.
CVSS v4.0
Score 2.1low
Affected software
parse-community
parse-server
pkg:github/parse-community/parse-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-35200 describes an interpretation conflict vulnerability (CWE-436) in parse-server where uploaded files can have a filename extension allowed by the system but a differing Content-Type header. The Content-Type header is passed directly to storage adapters without validation, causing adapters such as Amazon S3 or Google Cloud Storage to serve files with mismatched Content-Type headers. This can lead to incorrect content handling by clients. The vulnerability affects parse-server versions prior to 8.6.73 and 9.7.1-alpha.4. The default GridFS storage adapter is not vulnerable because it determines Content-Type based on the filename at serving time. The vulnerability has a low CVSS score of 2.1 and no known exploits in the wild.
Potential Impact
The impact is limited to files being served with an incorrect Content-Type header when using certain storage adapters (e.g., S3, GCS). This may cause clients to misinterpret the file content type, potentially leading to minor security or usability issues. There is no indication of direct code execution, privilege escalation, or data breach from this vulnerability. The default GridFS adapter is not affected.
Mitigation Recommendations
A fix is available in parse-server versions 8.6.73 and 9.7.1-alpha.4. Users should upgrade to these or later versions to resolve the issue. Since this is a cloud service, the vendor manages remediation for hosted services; users should verify with the vendor if using a managed parse-server instance. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-01T18:48:58.937Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 69d4982faaed68159ac9fe00
Added to database: 04/07/2026, 05:37:51 UTC
Last enriched: 04/14/2026, 16:10:52 UTC
Last updated: 09/13/2026, 10:01:30 UTC
Views: 195
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.