CVE-2025-64430

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2025-64430

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64430.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-64430

Aliases

Published

2025-11-07T17:55:27.768Z

Modified

2025-12-05T10:21:33.129496Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format

Details

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions 4.2.0 through 7.5.3, and 8.0.0 through 8.3.1-alpha.1, there is a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality when trying to upload a Parse.File with uri parameter, allowing execution of an arbitrary URI. The vulnerability stems from a file upload feature in which Parse Server retrieves the file data from a URI that is provided in the request. A request to the provided URI is executed, but the response is not stored in Parse Server's file storage as the server crashes upon receiving the response. This issue is fixed in versions 7.5.4 and 8.4.0-alpha.1.

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64430.json"
}

References

Affected packages

Git / github.com/parse-community/parse-server

Affected ranges

Type

GIT

Repo

https://github.com/parse-community/parse-server

Events

Introduced

1045eeb700798ac081b1d0731963312647daa436

Fixed

c9333dd7bc45eb9009649358db78ca66c6b8a2d5

Database specific

{
    "versions": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "7.5.4"
        }
    ]
}

Type

GIT

Repo

https://github.com/parse-community/parse-server

Events

Introduced

3cb3c5f7c628ed5f0598cd33df4abcc612862b98

Last affected

52bfb186fc4790073ac258bb30a7c599f469471e

Database specific

{
    "versions": [
        {
            "introduced": "8.0.0"
        },
        {
            "last_affected": "8.4.0-alpha.1"
        }
    ]
}

Affected versions

4.*

4.2.0

4.3.0

4.4.0

4.5.0

5.*

5.0.0

5.0.0-alpha.1

5.0.0-alpha.10

5.0.0-alpha.11

5.0.0-alpha.12

5.0.0-alpha.13

5.0.0-alpha.14

5.0.0-alpha.15

5.0.0-alpha.16

5.0.0-alpha.17

5.0.0-alpha.18

5.0.0-alpha.19

5.0.0-alpha.2

5.0.0-alpha.20

5.0.0-alpha.21

5.0.0-alpha.22

5.0.0-alpha.23

5.0.0-alpha.24

5.0.0-alpha.25

5.0.0-alpha.26

5.0.0-alpha.27

5.0.0-alpha.28

5.0.0-alpha.29

5.0.0-alpha.3

5.0.0-alpha.4

5.0.0-alpha.5

5.0.0-alpha.6

5.0.0-alpha.7

5.0.0-alpha.8

5.0.0-alpha.9

5.0.0-beta.1

5.0.0-beta.10

5.0.0-beta.2

5.0.0-beta.3

5.0.0-beta.4

5.0.0-beta.5

5.0.0-beta.6

5.0.0-beta.7

5.0.0-beta.8

5.0.0-beta.9

5.1.0

5.1.1

5.2.0

5.2.0-alpha.1

5.2.0-alpha.2

5.2.0-alpha.3

5.2.0-beta.1

5.2.0-beta.2

5.2.1

5.2.2

5.2.3

5.2.4

5.2.5

5.2.6

5.2.7

5.2.8

5.3.0

5.3.0-alpha.10

5.3.0-alpha.11

5.3.0-alpha.12

5.3.0-alpha.13

5.3.0-alpha.14

5.3.0-alpha.15

5.3.0-alpha.16

5.3.0-alpha.17

5.3.0-alpha.18

5.3.0-alpha.19

5.3.0-alpha.20

5.3.0-alpha.21

5.3.0-alpha.22

5.3.0-alpha.23

5.3.0-alpha.24

5.3.0-alpha.25

5.3.0-alpha.26

5.3.0-alpha.27

5.3.0-alpha.28

5.3.0-alpha.29

5.3.0-alpha.30

5.3.0-alpha.31

5.3.0-alpha.32

5.3.0-alpha.7

5.3.0-alpha.8

5.3.0-alpha.9

5.3.0-beta.1

5.3.1

5.3.2

5.3.3

5.4.0

5.4.0-alpha.1

5.4.0-beta.1

6.*

6.0.0

6.0.0-alpha.1

6.0.0-alpha.10

6.0.0-alpha.11

6.0.0-alpha.12

6.0.0-alpha.13

6.0.0-alpha.14

6.0.0-alpha.15

6.0.0-alpha.16

6.0.0-alpha.17

6.0.0-alpha.18

6.0.0-alpha.19

6.0.0-alpha.2

6.0.0-alpha.20

6.0.0-alpha.21

6.0.0-alpha.22

6.0.0-alpha.23

6.0.0-alpha.24

6.0.0-alpha.25

6.0.0-alpha.26

6.0.0-alpha.27

6.0.0-alpha.28

6.0.0-alpha.29

6.0.0-alpha.3

6.0.0-alpha.30

6.0.0-alpha.31

6.0.0-alpha.32

6.0.0-alpha.33

6.0.0-alpha.34

6.0.0-alpha.35

6.0.0-alpha.4

6.0.0-alpha.5

6.0.0-alpha.6

6.0.0-alpha.7

6.0.0-alpha.8

6.0.0-alpha.9

6.0.0-beta.1

6.1.0

6.1.0-alpha.1

6.1.0-alpha.10

6.1.0-alpha.11

6.1.0-alpha.12

6.1.0-alpha.13

6.1.0-alpha.14

6.1.0-alpha.15

6.1.0-alpha.16

6.1.0-alpha.17

6.1.0-alpha.18

6.1.0-alpha.19

6.1.0-alpha.2

6.1.0-alpha.20

6.1.0-alpha.3

6.1.0-alpha.4

6.1.0-alpha.5

6.1.0-alpha.6

6.1.0-alpha.7

6.1.0-alpha.8

6.1.0-alpha.9

6.1.0-beta.1

6.1.0-beta.2

6.2.0

6.2.1

6.2.2

6.3.0

6.3.0-alpha.1

6.3.0-alpha.2

6.3.0-alpha.3

6.3.0-alpha.4

6.3.0-alpha.5

6.3.0-alpha.6

6.3.0-alpha.7

6.3.0-alpha.8

6.3.0-alpha.9

6.3.0-beta.1

6.3.1

6.4.0

6.4.0-alpha.1

6.4.0-alpha.2

6.4.0-alpha.3

6.4.0-alpha.4

6.4.0-alpha.5

6.4.0-alpha.6

6.4.0-alpha.7

6.4.0-alpha.8

6.4.0-beta.1

6.5.0-alpha.1

6.5.0-alpha.2

6.5.0-beta.1

7.*

7.0.0

7.0.0-alpha.1

7.0.0-alpha.10

7.0.0-alpha.11

7.0.0-alpha.12

7.0.0-alpha.13

7.0.0-alpha.14

7.0.0-alpha.15

7.0.0-alpha.16

7.0.0-alpha.17

7.0.0-alpha.18

7.0.0-alpha.19

7.0.0-alpha.2

7.0.0-alpha.20

7.0.0-alpha.21

7.0.0-alpha.22

7.0.0-alpha.23

7.0.0-alpha.24

7.0.0-alpha.25

7.0.0-alpha.26

7.0.0-alpha.27

7.0.0-alpha.28

7.0.0-alpha.29

7.0.0-alpha.3

7.0.0-alpha.30

7.0.0-alpha.31

7.0.0-alpha.4

7.0.0-alpha.5

7.0.0-alpha.6

7.0.0-alpha.7

7.0.0-alpha.8

7.0.0-alpha.9

7.0.0-beta.1

7.1.0

7.1.0-alpha.1

7.1.0-alpha.10

7.1.0-alpha.11

7.1.0-alpha.12

7.1.0-alpha.13

7.1.0-alpha.14

7.1.0-alpha.15

7.1.0-alpha.16

7.1.0-alpha.2

7.1.0-alpha.3

7.1.0-alpha.4

7.1.0-alpha.5

7.1.0-alpha.6

7.1.0-alpha.7

7.1.0-alpha.8

7.1.0-alpha.9

7.1.0-beta.1

7.2.0

7.2.0-beta.1

7.3.0

7.3.0-alpha.1

7.3.0-alpha.2

7.3.0-alpha.3

7.3.0-alpha.4

7.3.0-alpha.5

7.3.0-alpha.6

7.3.0-alpha.7

7.3.0-alpha.8

7.3.0-alpha.9

7.3.0-beta.1

7.3.1-alpha.1

7.4.0

7.4.0-alpha.1

7.4.0-alpha.2

7.4.0-alpha.3

7.4.0-alpha.4

7.4.0-alpha.5

7.4.0-alpha.6

7.4.0-alpha.7

7.4.0-beta.1

7.5.0

7.5.1

7.5.2

7.5.3

8.*

8.0.0

8.0.1

8.0.1-alpha.1

8.0.1-alpha.2

8.0.2

8.0.2-alpha.1

8.1.0

8.1.0-alpha.1

8.1.0-alpha.2

8.1.0-alpha.3

8.1.0-alpha.4

8.1.1-alpha.1

8.2.0

8.2.0-alpha.1

8.2.1

8.2.1-alpha.1

8.2.1-alpha.2

8.2.2

8.2.2-alpha.1

8.2.3

8.2.3-alpha.1

8.2.4

8.2.4-alpha.1

8.2.5

8.2.5-alpha.1

8.3.0

8.3.0-alpha.1

8.3.0-alpha.10

8.3.0-alpha.11

8.3.0-alpha.12

8.3.0-alpha.13

8.3.0-alpha.14

8.3.0-alpha.2

8.3.0-alpha.3

8.3.0-alpha.4

8.3.0-alpha.5

8.3.0-alpha.6

8.3.0-alpha.7

8.3.0-alpha.8

8.3.0-alpha.9

8.3.1-alpha.1

8.4.0-alpha.1