medium5.9
CVE-2026-109301
Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and Liv…
Impact
Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.
Affected products
| Product | Affected versions |
|---|---|
| Parse Server | before 8.6.95 |
| 9.0.0 | before 9.10.2-alpha.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.