CVE-2026-55778 describes a vulnerability in parse-community's parse-server where the default fileUpload.fileExtensions blocklist could be bypassed by uploading files with non-standard or compound extensions combined with dangerous content types. This flaw allows attacker-supplied active content to be stored and served by storage adapters such as Amazon S3 and Google Cloud Storage, enabling stored cross-site scripting (XSS) attacks. The vulnerability affects versions prior to 8.6.81 and the 9.9.1-alpha.11 release. The issue is addressed in versions 8.6.81 and 9.9.1-alpha.11.

An attacker can upload files with dangerous content types that bypass the file extension restrictions, leading to the possibility of stored cross-site scripting attacks when these files are served from storage adapters like S3 or GCS. This could allow execution of malicious scripts in the context of users accessing the stored files. The CVSS 4.0 score is 2.1, indicating a low severity impact with network attack vector, low complexity, partial privileges required, and user interaction needed.

A patch is available and the vulnerability is fixed in parse-server versions 8.6.81 and 9.9.1-alpha.11. Users should upgrade to these or later versions to remediate the issue. Since this is a cloud-hosted service scenario, the vendor manages remediation for the cloud service; users should verify with the vendor advisory for their deployment. No additional mitigation steps are specified.