EUVD-2026-36539

🗓️ 19 Jun 2026 19:35:11Reported by EUVDType

Parse Server pre eight six seventy nine and pre nine nine one alpha four bypass blocklist with trailing dot, enabling stored XSS via Content-Type; GridFS safe; fixed.

Reporter	Title	Published	Views	Family All 12
CVE	CVE-2026-53724	12 Jun 202618:34	–	cve
Cvelist	CVE-2026-53724 Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist	12 Jun 202618:34	–	cvelist
Github Security Blog	parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist	19 Jun 202619:35	–	github
NVD	CVE-2026-53724	12 Jun 202619:16	–	nvd
OSV	BIT-PARSE-2026-53724 Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist	16 Jun 202612:40	–	osv
OSV	GHSA-7WQV-XJF3-X35V parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist	19 Jun 202619:35	–	osv
Patchstack	NPM: parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist	19 Jun 202619:35	–	patchstack
Positive Technologies	PT-2026-48960	12 Jun 202600:00	–	ptsecurity
Snyk	Cross-site Scripting (XSS)	12 Jun 202620:12	–	snyk
vulnersOsv	@openinc/parse-server-opendash (>=3.31.25 <=4.0.34) potentially affected by CVE-2026-53724 via parse-server (>=9.6.0-alpha.37 <=9.9.0)	12 Jun 202620:12	–	vulnersosv

[
  {
    "enisaIdVendor": [
      {
        "id": "71010d92-0100-3904-a162-acf4e29d3e12",
        "vendor": {
          "name": "parse-community"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "02de7028-49c2-3e87-92e5-5892a5c71cbb",
        "product": {
          "name": "parse-server",
          "vendor": {
            "name": "parse-community"
          }
        },
        "product_version": "9.0.0, < 9.9.1-alpha.4"
      },
      {
        "id": "84361bda-853e-36df-9756-87d231904f10",
        "product": {
          "name": "parse-server",
          "vendor": {
            "name": "parse-community"
          }
        },
        "product_version": "< 8.6.79"
      }
    ]
  }
]

Source	Link
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-7wqv-xjf3-x35v
github	www.github.com/parse-community/parse-server/pull/10489
github	www.github.com/parse-community/parse-server/pull/10490
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-53724

19 Jun 2026 19:35Current

5.8Medium risk

Vulners AI Score5.8

CVSS 42.1

EPSS0.00281

SSVC