CVE-2026-109301 (CVSS 5.9)

Description

Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.

Is your site exposed to CVE-2026-109301?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.9

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploit Prediction

0.0035

Probability of exploitation

0.27%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-248 CWE-248

References

Other References

https://github.com/parse-community/parse-server/security/advisories/GHSA-gpr6-gr9g-pfw6 https://www.vulncheck.com/advisories/parse-server-before-8.6.95-and-9.0.0-before-9.10.2-alpha.3-denial-of-service-via-file-pointer-without-url

Frequently Asked Questions

What is CVE-2026-109301? +

Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests. It has a CVSS v3.1 base score of 5.9 (MEDIUM).

How severe is CVE-2026-109301? +

CVE-2026-109301 has a CVSS v3.1 score of 5.9 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0035, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-109301? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-54908

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial …

CVE-2026-55780

NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in …

CVE-2026-53530

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics …

CVE-2026-96277

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.25.0. …

CVE-2026-46689

Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a …

CVE-2025-9124

A denial-of-service security issue in the affected product. The security issue stems from a fault occurring when a crafted CIP …

CVE-2026-109301