Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

Impact Parse Server's file upload validation uses the fileUpload.fileExtensions option enabled by default with a blocklist to reject files that browsers may render as active content, mitigating stored cross-site scripting XSS. When an uploaded file's extension is not recognized by the mime packag...