Parse Server before versions 8.6.79 and 9.9.1-alpha.4 has a CWE-434 vulnerability where the file upload extension blocklist can be bypassed by appending a trailing dot to a filename (e.g., poc.svg.). This causes the extension parser to extract an empty string, short-circuiting the blocklist check. Consequently, the attacker-controlled Content-Type header is forwarded unchanged to storage adapters such as S3 or GCS, which serve the file with an active MIME type like image/svg+xml. This behavior enables stored XSS attacks when victims open the file URL. The default GridFS adapter mitigates this by setting X-Content-Type-Options: nosniff on responses. The issue has been patched in versions 8.6.79 and 9.9.1-alpha.4.

An attacker can bypass the file upload extension blocklist by using filenames with trailing dots, causing storage adapters like S3 or GCS to serve malicious files with active content types. This enables stored cross-site scripting (XSS) attacks when victims access the uploaded file URLs. The vulnerability does not affect the default GridFS adapter due to its security headers. The CVSS 4.0 score is low (2.1), reflecting limited impact and required privileges.

A patch is available and has been applied in Parse Server versions 8.6.79 and 9.9.1-alpha.4. Users should upgrade to these or later versions to remediate this vulnerability. Since this is a cloud service, the vendor manages remediation for hosted instances; verify with the vendor's advisory for cloud-hosted environments. No additional mitigation steps are indicated by the vendor advisory.