Impact

Parse Server crashes when uploading a file without extension.

Patches

A permanent fix has been implemented to prevent the server from crashing.

Workarounds

There are no known workarounds.

References

• GitHub security advisory: GHSA-792q-q67h-w579
• Patched in Parse Server 6: https://github.com/parse-community/parse-server/releases/tag/6.3.1
• Patched in Parse Server 5 (LTS): https://github.com/parse-community/parse-server/releases/tag/5.5.6

References

• GHSA-792q-q67h-w579
• parse-community/parse-server@686a9f2
• parse-community/parse-server@fd86278
• https://github.com/parse-community/parse-server/releases/tag/5.5.6
• https://github.com/parse-community/parse-server/releases/tag/6.3.1
• https://nvd.nist.gov/vuln/detail/CVE-2023-46119