What is CVE-2026-30948?

CVE-2026-30948 is a medium-severity vulnerability in Parse-Community Parse-Server, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-03-10.

How severe is CVE-2026-30948?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Parse-Community Parse-Server

CVE-2026-30948

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.4 and 8.6.17, a stored cross-site scripting (XSS) vulnerability allows any authenticated user to upload an SVG file containing JavaScript. The file is served inline with Content-Type: image/svg+xml and without protective headers, causing the browser to execute embedded scripts in the Parse Server origin. This can be exploited to steal session tokens from localStorage and achieve account takeover. The default fileExtensions option blocks HTML file extensions but does not block SVG, which is a well-known XSS vector. All Parse Server deployments where file upload is enabled for authenticated users (the default) are affected. This vulnerability is fixed in 9.5.2-alpha.4 and 8.6.17.

Vulnerability class: XSS (Cross-Site Scripting)

Published 2026-03-10 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

EPSS exploit prediction

EPSS: 0.003 (19.9th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 20th percentile — 19.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001

Affected products

Parse-Community Parse-Server — versions >= 9.0.0 < 9.5.2-alpha.4, < 8.6.17
Parseplatform Parse-Server — versions 9.5.2

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

github.com/parse-community/parse-server/security/advisories/GHSA-hcj7-6gxh-24ww (Patch, Mitigation, Vendor Advisory)
github.com/parse-community/parse-server/releases/tag/8.6.17 (Product, Release Notes)
github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.4 (Product, Release Notes)

Frequently asked questions

What is CVE-2026-30948?: CVE-2026-30948 is a medium-severity vulnerability in Parse-Community Parse-Server, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-03-10.
How severe is CVE-2026-30948?: Medium severity. CVSS v3 base score is 5.4 out of 10.