Detections
Analytics

SCA: security update for parse-server (GHSA-42ph-pf9q-cr72)

high Tenable Self-Hosted Container Security Plugin ID 438826

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.
 Prior to 9.6.0-alpha.15 and 8.6.41, an attacker who is allowed to upload files can bypass the file
 extension filter by appending a MIME parameter (e.g. `;charset=utf-8`) to the `Content-Type` header. This
 causes the extension validation to fail matching against the blocklist, allowing active content to be
 stored and served under the application's domain. In addition, certain XML-based file extensions that can
 render scripts in web browsers are not included in the default blocklist. This can lead to stored XSS
 attacks, compromising session tokens, user credentials, or other sensitive data accessible via the
 browser's local storage. The fix in versions 9.6.0-alpha.15 and 8.6.41 strips MIME parameters from the
 `Content-Type` header before validating the file extension against the blocklist. The default blocklist
 has also been extended to include additional XML-based extensions (`xsd`, `rng`, `rdf`, `rdf+xml`, `owl`,
 `mathml`, `mathml+xml`) that can render active content in web browsers. Note that the
 `fileUpload.fileExtensions` option is intended to be configured as an allowlist of file extensions that
 are valid for a specific application, not as a denylist. The default denylist is provided only as a basic
 default that covers most common problematic extensions. It is not intended to be an exhaustive list of all
 potentially dangerous extensions. Developers should not rely on the default value, as new extensions that
 can render active content in browsers might emerge in the future. As a workaround, configure the
 `fileUpload.fileExtensions` option to use an allowlist of only the file extensions that your application
 needs, rather than relying on the default blocklist. (CVE-2026-32728)

Solution

Update the parse-server library and its related packages to version 8.6.41 or later.

See Also

https://github.com/advisories/GHSA-42ph-pf9q-cr72

Plugin Details

Severity: High

ID: 438826

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 3/16/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.77

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:P/A:N

CVSS Score Source: CVE-2026-32728

CVSS v3

Risk Factor: High

Base Score: 7.6

Temporal Score: 6.6

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.3

Threat Score: 5.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/16/2026

Vulnerability Publication Date: 3/16/2026

Reference Information

CVE: CVE-2026-32728

cwe: CWE-79