{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-24T11:20:03.414","vulnerabilities":[{"cve":{"id":"CVE-2026-30848","sourceIdentifier":"security-advisories@github.com","published":"2026-03-07T17:15:52.190","lastModified":"2026-06-17T10:33:01.603","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.8 and 9.5.0-alpha.8, the PagesRouter static file serving route is vulnerable to a path traversal attack that allows unauthenticated reading of files outside the configured pagesPath directory. The boundary check uses a string prefix comparison without enforcing a directory separator boundary. An attacker can use path traversal sequences to access files in sibling directories whose names share the same prefix as the pages directory (e.g. pages-secret starts with pages). This issue has been patched in versions 8.6.8 and 9.5.0-alpha.8."},{"lang":"es","value":"Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 8.6.8 y 9.5.0-alpha.8, la ruta de servicio de archivos estáticos de PagesRouter es vulnerable a un ataque de salto de ruta que permite la lectura no autenticada de archivos fuera del directorio pagesPath configurado. La verificación de límites utiliza una comparación de prefijo de cadena sin aplicar un límite de separador de directorio. Un atacante puede usar secuencias de salto de ruta para acceder a archivos en directorios hermanos cuyos nombres comparten el mismo prefijo que el directorio pages (por ejemplo, pages-secret comienza con pages). Este problema ha sido parcheado en las versiones 8.6.8 y 9.5.0-alpha.8."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"parse-community","product":"parse-server","versions":[{"version":"< 8.6.8","status":"affected"},{"version":"< 9.5.0-alpha.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-09T17:38:49.481521Z","id":"CVE-2026-30848","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*","versionEndExcluding":"8.6.8","matchCriteriaId":"7BAC0476-CA4F-42DB-BDA2-365203EDCAA7"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.5.0","matchCriteriaId":"77A07A2F-C8ED-4D78-A9C0-66AB42F69F38"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha1:*:*:*:node.js:*:*","matchCriteriaId":"3E9F95CF-EEE1-42FC-904E-321F05E3DE4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha2:*:*:*:node.js:*:*","matchCriteriaId":"5C02D6F0-5A3A-45F5-8A74-F75A8CCAE7DE"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha3:*:*:*:node.js:*:*","matchCriteriaId":"103C9745-031B-4822-A19C-A61375FBB1AD"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha4:*:*:*:node.js:*:*","matchCriteriaId":"8D67029D-C1BD-4D46-A84F-C52B4D364268"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha5:*:*:*:node.js:*:*","matchCriteriaId":"3B10930D-B416-4D9A-BA26-F0AD22BFAE28"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha6:*:*:*:node.js:*:*","matchCriteriaId":"72794836-5CFB-4928-BB22-D7DE813809B4"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha7:*:*:*:node.js:*:*","matchCriteriaId":"FA2C4C1E-3AE6-48E0-8B59-80554AE85BB0"}]}]}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-hm3f-q6rw-m6wh","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}