Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-msej-ykyc-qyhp
Vulnerability ID VCID-msej-ykyc-qyhp
Aliases CVE-2023-32689
GHSA-9prm-jqwx-45x9
Summary Phishing attack vulnerability by uploading malicious HTML file Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 is vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A malicious user could upload an HTML file to Parse Server via its public API. That HTML file would then be accessible at the internet domain at which Parse Server is hosted. The URL of the the uploaded HTML could be shared for phishing attacks. The HTML page may seem legitimate because it is served under the internet domain where Parse Server is hosted, which may be the same as a company's official website domain. An additional security issue arises when the Parse JavaScript SDK is used. The SDK stores sessions in the internet browser's local storage, which usually restricts data access depending on the internet domain. A malicious HTML file could contain a script that retrieves the user's session token from local storage and then share it with the attacker. The fix included in versions 5.4.4 and 6.1.1 adds a new Parse Server option `fileUpload.fileExtensions` to restrict file upload on Parse Server by file extension. It is recommended to restrict file upload for HTML file extensions, which this fix disables by default. If an app requires upload of files with HTML file extensions, the option can be set to `['.*']` or another custom value to override the default.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2023-32689
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2023-32689
epss 0.0039 https://api.first.org/data/v1/epss?cve=CVE-2023-32689
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-9prm-jqwx-45x9
cvssv3.1 6.3 https://github.com/parse-community/parse-server
generic_textual MODERATE https://github.com/parse-community/parse-server
cvssv3.1 6.3 https://github.com/parse-community/parse-server/pull/8537
generic_textual MODERATE https://github.com/parse-community/parse-server/pull/8537
ssvc Track https://github.com/parse-community/parse-server/pull/8537
cvssv3.1 6.3 https://github.com/parse-community/parse-server/pull/8538
generic_textual MODERATE https://github.com/parse-community/parse-server/pull/8538
ssvc Track https://github.com/parse-community/parse-server/pull/8538
cvssv3.1 6.3 https://github.com/parse-community/parse-server/security/advisories/GHSA-9prm-jqwx-45x9
cvssv3.1_qr MODERATE https://github.com/parse-community/parse-server/security/advisories/GHSA-9prm-jqwx-45x9
generic_textual MODERATE https://github.com/parse-community/parse-server/security/advisories/GHSA-9prm-jqwx-45x9
ssvc Track https://github.com/parse-community/parse-server/security/advisories/GHSA-9prm-jqwx-45x9
cvssv3.1 6.3 https://nvd.nist.gov/vuln/detail/CVE-2023-32689
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2023-32689
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-32689
https://github.com/parse-community/parse-server
https://github.com/parse-community/parse-server/pull/8537
https://github.com/parse-community/parse-server/pull/8538
CVE-2023-32689 https://nvd.nist.gov/vuln/detail/CVE-2023-32689
GHSA-9prm-jqwx-45x9 https://github.com/advisories/GHSA-9prm-jqwx-45x9
GHSA-9prm-jqwx-45x9 https://github.com/parse-community/parse-server/security/advisories/GHSA-9prm-jqwx-45x9
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/parse-community/parse-server
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/parse-community/parse-server/pull/8537
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-10T19:07:11Z/ Found at https://github.com/parse-community/parse-server/pull/8537
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/parse-community/parse-server/pull/8538
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-10T19:07:11Z/ Found at https://github.com/parse-community/parse-server/pull/8538
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-9prm-jqwx-45x9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-10T19:07:11Z/ Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-9prm-jqwx-45x9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-32689
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.60431
EPSS Score 0.0039
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:44:54.579805+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/parse-server/CVE-2023-32689.yml 38.6.0