parse-community parse-server up to 8.6.7/9.5.0-alpha.7 path traversal

Summaryinfo

A vulnerability described as critical has been identified in parse-community parse-server up to 8.6.7/9.5.0-alpha.7. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to path traversal. This vulnerability is registered as CVE-2026-30848. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in parse-community parse-server up to 8.6.7/9.5.0-alpha.7 and classified as critical. This vulnerability affects an unknown code block. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. CVE summarizes:

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.8 and 9.5.0-alpha.8, the PagesRouter static file serving route is vulnerable to a path traversal attack that allows unauthenticated reading of files outside the configured pagesPath directory. The boundary check uses a string prefix comparison without enforcing a directory separator boundary. An attacker can use path traversal sequences to access files in sibling directories whose names share the same prefix as the pages directory (e.g. pages-secret starts with pages). This issue has been patched in versions 8.6.8 and 9.5.0-alpha.8.

The advisory is available at github.com. This vulnerability was named CVE-2026-30848 since 03/05/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

Upgrading to version 8.6.8 or 9.5.0-alpha.8 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-10169). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• parse-community

Name

• parse-server

Version

• 8.6.0
• 8.6.1
• 8.6.2
• 8.6.3
• 8.6.4
• 8.6.5
• 8.6.6
• 8.6.7
• 9.5.0-alpha.0
• 9.5.0-alpha.1
• 9.5.0-alpha.2
• 9.5.0-alpha.3
• 9.5.0-alpha.4
• 9.5.0-alpha.5
• 9.5.0-alpha.6
• 9.5.0-alpha.7

Website

• Product: https://github.com/parse-community/parse-server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion