What’s Vulnerable › Vulnerabilities

CVE-2023-46119: Parse Server may crash when uploading file without extension

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-25 · updated 2026-06-17
• Weakness: CWE-23

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1.

Affected products

• parse-community parse-server: from 1.0.0 before 5.5.6; from 6.0.0 before 6.3.1 — fixed in 5.5.6, 6.3.1

How to fix

Upgrade to a fixed version: parse-community parse-server 5.5.6, 6.3.1. Check the vendor advisory for mitigations.

References

• https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe
• https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0
• https://github.com/parse-community/parse-server/releases/tag/5.5.6
• https://github.com/parse-community/parse-server/releases/tag/6.3.1
• https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
• https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe
• https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0
• https://github.com/parse-community/parse-server/releases/tag/5.5.6
• https://github.com/parse-community/parse-server/releases/tag/6.3.1
• https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579

Get alerted when CVE-2023-46119 or the next vulnerability affects your stack