CVE-2026-30228

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-30228

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30228.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-30228

Aliases

Published

2026-03-06T20:25:35.327Z

Modified

2026-03-14T08:45:50.874384Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction

Details

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-alpha.3, the readOnlyMasterKey can be used to create and delete files via the Files API (POST /files/:filename, DELETE /files/:filename). This bypasses the read-only restriction which violates the access scope of the readOnlyMasterKey. Any Parse Server deployment that uses readOnlyMasterKey and exposes the Files API is affected. An attacker with access to the readOnlyMasterKey can upload arbitrary files or delete existing files. This issue has been patched in versions 8.6.5 and 9.5.0-alpha.3.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30228.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ]
}

References

Affected packages

Git / github.com/parse-community/parse-server

Affected ranges

Type: GIT
Repo: https://github.com/parse-community/parse-server
Events: Introduced

532a461d30a6ed4457839f2caf5f30d5abf51a55

Fixed

a38b81a5858755d44e0e62ebe371513c0b0714fe

Affected versions

9.*

9.0.0

9.1.0

9.1.0-alpha.1

9.1.0-alpha.2

9.1.0-alpha.3

9.1.0-alpha.4

9.1.1

9.1.1-alpha.1

9.2.0

9.2.0-alpha.1

9.2.0-alpha.2

9.2.0-alpha.3

9.2.0-alpha.4

9.2.0-alpha.5

9.2.1-alpha.1

9.2.1-alpha.2

9.3.0

9.3.0-alpha.1

9.3.0-alpha.2

9.3.0-alpha.3

9.3.0-alpha.4

9.3.0-alpha.5

9.3.0-alpha.6

9.3.0-alpha.7

9.3.0-alpha.8

9.3.0-alpha.9

9.3.1

9.3.1-alpha.1

9.3.1-alpha.2

9.3.1-alpha.3

9.3.1-alpha.4

9.4.0

9.4.0-alpha.1

9.4.0-alpha.2

9.4.1

9.4.1-alpha.1

9.4.1-alpha.2

9.4.1-alpha.3

9.5.0-alpha.1

9.5.0-alpha.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30228.json"