Parse Server suffers from a stored XSS vulnerability in versions >=9.0.0 <9.10.0-alpha.2 and <=8.6.83 due to improper handling of uploaded file Content-Type headers. When the mime package does not recognize a file extension, Parse Server retains the client-supplied Content-Type, even if malformed (e.g., 'image', 'image/', 'image//svg+xml'). Such malformed types bypass the fileUpload.fileExtensions blocklist and are stored unchanged. On storage adapters that serve the Content-Type header (e.g., Amazon S3, Google Cloud Storage, Azure Blob Storage), browsers fail to parse the malformed Content-Type and resort to MIME-sniffing. If the file content begins with HTML, it is rendered as HTML, enabling XSS attacks in the application's origin context. The default GridFS adapter does not exhibit this behavior. The vulnerability is patched in versions 9.10.0-alpha.2 and 8.6.84.

An attacker can upload files with malicious scripts that bypass file extension restrictions due to malformed Content-Type headers. When these files are served from certain storage adapters, browsers may execute embedded scripts, resulting in stored cross-site scripting (XSS) attacks. This can lead to script execution in the context of the vulnerable application's origin, potentially affecting users who access the malicious file URLs. The CVSS 4.0 score is low (2.1), reflecting the requirement for user interaction and limited scope of impact.

A fix is available and has been released in Parse Server versions 9.10.0-alpha.2 and 8.6.84. Users should upgrade to these or later versions to remediate the vulnerability. Since this is a cloud-hosted service, the vendor manages remediation for the cloud environment; users should verify with the vendor that their deployment is updated. No additional mitigation steps are indicated by the vendor advisory.