CVE Explorer

CVE-2025-64430

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions 4.2.0 through 7.5.3, and 8.0.0 through 8.3.1-alpha.1, there is a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality when trying to upload a Parse.File with uri parameter, allowing execution of an arbitrary URI. The vulnerability stems from a file upload feature in which Parse Server retrieves the file data from a URI that is provided in the request. A

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:fc8ba73875c33b595c0f11f7f897912d27276336665f10caf3603a26a08f5024

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"parse-server","vendor":"parse-community","versions":[{"status":"affected","version":">= 4.2.0, < 7.5.4"},{"status":"affected","version":">= 8.0.0, <= 8.4.0-alpha.1"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:0dce43644f88b44b75c4c9e1a4a8616accf3feeaa66e78108d46f1694fe8bc49 · sha256:c4a4f34666667412… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:0dce43644f88b44b75c4c9e1a4a8616accf3feeaa66e78108d46f1694fe8bc49 · sha256:c4a4f34666667412… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:0dce43644f88b44b75c4c9e1a4a8616accf3feeaa66e78108d46f1694fe8bc49 · sha256:c4a4f34666667412… · /containers/cna/problemTypes/0/descriptions/0

Source references

5 source assertions

{"name":"https://github.com/parse-community/parse-server/commit/8bbe3efbcf4a3b66f4a8db9bfb18cd98c050db51","tags":["x_refsource_MISC"],"url":"https://github.com/parse-community/parse-server/commit/8bbe3efbcf4a3b66f4a8db9bfb18cd98c050db51"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:0dce43644f88b44b75c4c9e1a4a8616accf3feeaa66e78108d46f1694fe8bc49 · sha256:c4a4f34666667412… · /containers/cna/references/3

{"name":"https://github.com/parse-community/parse-server/commit/97763863b72689a29ad7a311dfb590c3e3c50585","tags":["x_refsource_MISC"],"url":"https://github.com/parse-community/parse-server/commit/97763863b72689a29ad7a311dfb590c3e3c50585"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:0dce43644f88b44b75c4c9e1a4a8616accf3feeaa66e78108d46f1694fe8bc49 · sha256:c4a4f34666667412… · /containers/cna/references/4

{"name":"https://github.com/parse-community/parse-server/pull/9903","tags":["x_refsource_MISC"],"url":"https://github.com/parse-community/parse-server/pull/9903"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:0dce43644f88b44b75c4c9e1a4a8616accf3feeaa66e78108d46f1694fe8bc49 · sha256:c4a4f34666667412… · /containers/cna/references/1

{"name":"https://github.com/parse-community/parse-server/pull/9904","tags":["x_refsource_MISC"],"url":"https://github.com/parse-community/parse-server/pull/9904"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:0dce43644f88b44b75c4c9e1a4a8616accf3feeaa66e78108d46f1694fe8bc49 · sha256:c4a4f34666667412… · /containers/cna/references/2

{"name":"https://github.com/parse-community/parse-server/security/advisories/GHSA-x4qj-2f4q-r4rx","tags":["x_refsource_CONFIRM"],"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-x4qj-2f4q-r4rx"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:0dce43644f88b44b75c4c9e1a4a8616accf3feeaa66e78108d46f1694fe8bc49 · sha256:c4a4f34666667412… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer