CVE-2026-30848: Parse Server Path Traversal Vulnerability in PagesRouter
Summary
CVE-2026-30848: Parse Server: PagesRouter path traversal allows reading files outside configured pages directory. Affects parse-server across 2 version ranges.
< 8.6.8
>= 9.0.0-alpha.1, < 9.5.0-alpha.8
Fixed in 8.6.8 or 9.5.0-alpha.8, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-30848 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that enables developers to build applications with a robust server-side infrastructure. It provides features such as data storage, user authentication, and file management. The PagesRouter feature allows serving static files from a specified directory. However, a vulnerability exists that can expose sensitive files outside the designated directory, compromising application security.
Vulnerability Detail
The vulnerability in Parse Server's PagesRouter arises from a flawed boundary check that permits path traversal attacks. This allows an unauthenticated attacker to read files outside the configured pagesPath directory. The issue stems from the use of a string prefix comparison that does not enforce a directory separator boundary, enabling attackers to exploit sibling directories with similar names. This can lead to unauthorized access to sensitive information, posing a significant risk to applications utilizing the pages feature.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.88.6.8npm install parse-server@8.6.8 -
>= 9.0.0-alpha.1, < 9.5.0-alpha.89.5.0-alpha.8npm install parse-server@9.5.0-alpha.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that the pagesPath directory does not have any sibling directories whose names begin with the same prefix. For example, if your pagesPath is /srv/pages, make sure there are no directories like /srv/pages-backup or /srv/pages_old alongside it.
Conclusion
The CVE-2026-30848 vulnerability in Parse Server's PagesRouter poses a significant risk due to its potential for path traversal attacks. It is crucial for developers to update their packages to the latest versions to safeguard their applications. Implementing the provided workaround can offer temporary relief until a full update is feasible.
See every vulnerability recorded for parse-server →
FAQ
The CVSS score of this vulnerability is 6.3, indicating a moderate level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to sensitive files, potentially compromising user data and application integrity.
Yes, the permanent fix involves updating the parse-server package to the specified patched versions.
If immediate updates are not possible, implement the suggested workaround to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
