CVE-2026-30228

The record

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-alpha.3, the readOnlyMasterKey can be used to create and delete files via the Files API (POST /files/:filename, DELETE /files/:filename). This bypasses the read-only restriction which violates the access scope of the readOnlyMasterKey. Any Parse Server deployment that uses readOnlyMasterKey and exposes the Files API is affected. An attacker with access to the readOnlyMasterKey can upload arbitrary files or delete existing files. This issue has been patched in versions 8.6.5 and 9.5.0-alpha.3.

Affected packages

Related vulnerabilities

• GHSA-xfh7-phr7-gr2x parse-server's file creation and deletion bypasses `readOnlyMasterKey` write restriction Same vulnerability
• GHSA-97pr-9hgg-3p8r parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access… Also affects parse-server
• GHSA-wmwx-jr2p-4j4r parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL Also affects parse-server
• GHSA-7wqv-xjf3-x35v parse-server: Stored XSS via trailing-dot filename bypassing file upload extension… Also affects parse-server
• GHSA-p84r-h6rx-f2xr parse-server: Server option routeAllowList is bypassable through batch sub-requests Also affects parse-server
• GHSA-cgxm-vr2f-6fj8 parse-server: Denial of service via exponential-time processing of deeply nested query… Also affects parse-server
• CVE-2026-53726 Parse Server is an open source backend that can be deployed to any infrastructure that… Also affects parse-server
• CVE-2026-53724 Parse Server is an open source backend that can be deployed to any infrastructure that… Also affects parse-server