CVE-2026-109301
Received Received - Intake

Parse Server Cloud Code Trigger File Reference Handling Flaw

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109301
EUVD
EUVD-2026-97603

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
parse-community parse-server 9.0.0
parse-community parse-server 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Parse Server versions before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 fail to handle file references without a URL properly. This causes an uncaught exception when objects are passed to Cloud Code triggers or LiveQuery, leading to server crashes or broken requests.

Detection Guidance

Detecting this vulnerability requires checking if your Parse Server version is affected. Run: npm list parse-server to check the installed version. If it is below 8.6.95 or 9.0.0 before 9.10.2-alpha.3, the system is vulnerable.

Impact Analysis

Attackers with write access to a class using Cloud Code triggers or LiveQuery can crash the server or disrupt services. This includes unauthenticated users if public write access or sign-up is enabled, potentially causing downtime or data processing failures.

Compliance Impact

This vulnerability could lead to service disruptions or data processing failures, which may violate availability requirements in GDPR or HIPAA. Downtime or corrupted requests could impact data integrity and access controls.

Mitigation Strategies

Upgrade Parse Server to version 8.6.95 or 9.10.2-alpha.3 or later. If upgrading is not immediately possible, restrict write access to classes with Cloud Code triggers or LiveQuery enabled to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109301. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart