CVE-2026-30948: Parse Server Stored XSS Vulnerability via SVG File Upload
Summary
CVE-2026-30948: Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload. Affects parse-server across 2 version ranges.
< 8.6.17
>= 9.0.0, < 9.5.2-alpha.4
Fixed in 8.6.17 or 9.5.2-alpha.4, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-30948 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that enables developers to build applications with a robust server-side infrastructure. It provides features such as data storage, user management, and file uploads, making it a popular choice for mobile and web applications. However, it has been found to be vulnerable to a stored cross-site scripting (XSS) attack through SVG file uploads, which can compromise user accounts and data integrity.
Vulnerability Detail
The vulnerability arises from the ability of authenticated users to upload SVG files containing JavaScript code. When these files are served with the Content-Type 'image/svg+xml' and without protective headers, the browser executes the embedded scripts. This can lead to session token theft from localStorage, allowing attackers to take over user accounts. The default configuration of Parse Server does not block SVG uploads, making it susceptible to this well-known XSS vector.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.178.6.17npm install parse-server@8.6.17 -
>= 9.0.0, < 9.5.2-alpha.49.5.2-alpha.4npm install parse-server@9.5.2-alpha.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, configure the 'fileExtensions' option in your Parse Server settings to explicitly block SVG uploads. You can do this by adding the following code to your configuration:
{
fileUpload: {
fileExtensions: ['^(?!([xXsS]?[hH][tT][mM][lL]?|[sS][vV][gG])$)']
}
}
Conclusion
The stored XSS vulnerability in Parse Server via SVG file uploads poses a significant risk to applications using this framework. It is crucial to update to the patched versions or implement the recommended workaround to mitigate the risk of exploitation.
See every vulnerability recorded for parse-server →
FAQ
Stored XSS is a type of security vulnerability where an attacker can inject malicious scripts into a web application, which are then stored on the server and executed in the browser of users who access the affected page.
If exploited, this vulnerability can allow attackers to steal session tokens, leading to unauthorized access and account takeover, compromising user data and application integrity.
All versions of Parse Server where file upload is enabled for authenticated users are affected, specifically versions prior to 9.5.2-alpha.4 and 8.6.17.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score for this vulnerability is 8.3, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
