Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-gkng-gbtu-hkc1
Vulnerability ID VCID-gkng-gbtu-hkc1
Aliases CVE-2023-46119
GHSA-792q-q67h-w579
Summary Parse Server may crash when uploading file without extension ### Impact Parse Server crashes when uploading a file without extension. ### Patches A permanent fix has been implemented to prevent the server from crashing. ### Workarounds There are no known workarounds. ### References - GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579 - Patched in Parse Server 6: https://github.com/parse-community/parse-server/releases/tag/6.3.1 - Patched in Parse Server 5 (LTS): https://github.com/parse-community/parse-server/releases/tag/5.5.6
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-23 Relative Path Traversal
System Score Found at
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2023-46119
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2023-46119
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2023-46119
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-792q-q67h-w579
cvssv3.1 7.5 https://github.com/parse-community/parse-server
generic_textual HIGH https://github.com/parse-community/parse-server
cvssv3.1 7.5 https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe
generic_textual HIGH https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe
ssvc Track https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe
cvssv3.1 7.5 https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0
generic_textual HIGH https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0
ssvc Track https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0
cvssv3.1 7.5 https://github.com/parse-community/parse-server/releases/tag/5.5.6
generic_textual HIGH https://github.com/parse-community/parse-server/releases/tag/5.5.6
ssvc Track https://github.com/parse-community/parse-server/releases/tag/5.5.6
cvssv3.1 7.5 https://github.com/parse-community/parse-server/releases/tag/6.3.1
generic_textual HIGH https://github.com/parse-community/parse-server/releases/tag/6.3.1
ssvc Track https://github.com/parse-community/parse-server/releases/tag/6.3.1
cvssv3.1 7.5 https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
cvssv3.1_qr HIGH https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
generic_textual HIGH https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
ssvc Track https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-46119
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-46119
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-46119
https://github.com/parse-community/parse-server
https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe
https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0
https://github.com/parse-community/parse-server/releases/tag/5.5.6
https://github.com/parse-community/parse-server/releases/tag/6.3.1
https://nvd.nist.gov/vuln/detail/CVE-2023-46119
GHSA-792q-q67h-w579 https://github.com/advisories/GHSA-792q-q67h-w579
GHSA-792q-q67h-w579 https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/parse-community/parse-server
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-10T15:28:20Z/ Found at https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-10T15:28:20Z/ Found at https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/parse-community/parse-server/releases/tag/5.5.6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-10T15:28:20Z/ Found at https://github.com/parse-community/parse-server/releases/tag/5.5.6
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/parse-community/parse-server/releases/tag/6.3.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-10T15:28:20Z/ Found at https://github.com/parse-community/parse-server/releases/tag/6.3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-10T15:28:20Z/ Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-46119
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.69
EPSS Score 0.0057
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:46:10.863060+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/parse-server/CVE-2023-46119.yml 38.6.0