CVE-2026-35200

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73 and 9.7.1-alpha.4, a file can be uploaded with a filename extension that passes the file extension allowlist (e.g., .txt) but with a Content-Type header that differs from the extension (e.g., text/html). The Content-Type is passed to the storage adapter without consistency validation. Storage adapters that store and serve the provided Content-Type (such as S3 or GCS) serve the file with the mismatched Content-Type. The default GridFS adapter is not affected because it derives Content-Type from the filename at serving time. This vulnerability is fixed in 8.6.73 and 9.7.1-alpha.4.

• CWE-436

• https://github.com/parse-community/parse-server/pull/10383Issue Tracking, Patch
• https://github.com/parse-community/parse-server/pull/10384Issue Tracking, Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-vr5f-2r24-w5hcMitigation, Patch, Vendor Advisory

Published

Apr 6, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35195Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0…5.4
• CVE-2026-35196Chamilo LMS is an open-source learning management system. In…8.8
• CVE-2026-35197dye is a portable and respectful color library for shell scr…9.8
• CVE-2026-35198HeyForm is an open-source form builder. Prior to version 3.0…9
• CVE-2026-35199SymCrypt is the core cryptographic function library currentl…6.1
• CVE-2026-3520Multer is a node.js middleware for handling `multipart/form-…7.5
• CVE-2026-35201Discount is an implementation of John Gruber's Markdown mark…5.9
• CVE-2026-35202Pterodactyl is a free, open-source game server management pa…2.3
• CVE-2026-35203ZLMediaKit is a streaming media service framework. the VP9 R…7.5
• CVE-2026-35204Helm is a package manager for Charts for Kubernetes. From 4.…8.6
• CVE-2026-35205Helm is a package manager for Charts for Kubernetes. From 4.…7.8
• CVE-2026-35206Helm is a package manager for Charts for Kubernetes. In Helm…4.4