Parse Server: Denial of service via file reference without URL

Summary

Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references without a URL before passing objects to Cloud Code triggers and LiveQuery. The resulting uncaught exception terminates the server process or breaks subsequent requests. Attackers who can write to a class with Cloud Code save, find or delete triggers or LiveQuery enabled can trigger this, including unauthenticated users when public write access or sign-up is allowed. The CNA rates it CVSS 4.0 8.2 (High); other sources rate it lower (CVSS 3.1 5.9, VulDB 5.3), and the impact is limited to availability.

Affected

• parse-server 9.0.0 up to before 9.10.2-alpha.3
• parse-server before 8.6.95

Fixed in

• parse-server 8.6.95
• parse-server 9.10.2-alpha.3
• parse-server 9.10.2 (stable release that includes the same fix)

Workaround

• No vendor workaround found. The advisory describes a middleware in front of Parse Server that rejects write requests containing an object with __type File without a url or with a non-string name. This also blocks legitimate requests that reference an existing file by name only.
• Interim measure (own recommendation, not vendor guidance): review class-level permissions and disable public write access or open sign-up where not needed.

Exploitation

• Not known to be exploited. The sources checked do not mark it as known exploited; CISA KEV was not checked directly.
• No public proof of concept found in the searches performed; this is not fully verified.
• EPSS 0.00348. CISA SSVC: exploitation none, not automatable, partial technical impact.

Our recommendation

• Upgrade to parse-server 8.6.95 or 9.10.2-alpha.3 (or stable 9.10.2) without delay, especially for internet-facing instances with public APIs.
• Check whether any class with Cloud Code triggers or LiveQuery allows public write access or open sign-up, and restrict it where not required.
• Monitor for unexpected process restarts and failing requests as indicators of exploitation.
• Internal-only deployments with restricted permissions have lower priority but should still be patched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-gpr6-gr9g-pfw6 github.com
• VulnCheck advisory www.vulncheck.com
• Parse Server release 8.6.95 github.com
• Parse Server release 9.10.2-alpha.3 github.com
• Parse Server release 9.10.2 github.com
• OSV entry CVE-2026-109301 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:38.