Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.8 and 9.5.0-alpha.8, the PagesRouter static file serving route is vulnerable to a path traversal attack that allows unauthenticated reading of files outside the configured pagesPath directory. The boundary check uses a string prefix comparison without enforcing a directory separator boundary. An attacker can use path traversal sequences to access files in sibling directories whose names share the same prefix as the pages directory (e.g. pages-secret starts with pages). This issue has been patched in versions 8.6.8 and 9.5.0-alpha.8.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-07 | 2 | Disclosure2 |
| 2026-03-09 | 1 | Disclosure1 |
🟠 Parse Server, Path Traversal, #CVE-2026-30848 (Medium) https://dailycve.com/parse-server-path-traversal-cve-2026-30848-medium/
Post summary
The post announces a medium‑severity path traversal vulnerability (CVE‑2026‑30848) in Parse Server, linking to an external article for details.
CVE-2026-30848 Path Traversal Vulnerability in Parse Server Allows Unauthenticated File Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30848
Post summary
The text announces a path traversal flaw in Parse Server that permits unauthenticated file access, but offers no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-30848 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.8 and 9.5.0-alpha.8, the PagesRouter sta… https://www.cve.org/CVERecord?id=CVE-2026-30848
Post summary
The message announces the existence of CVE-2026-30848 for Parse Server, noting affected versions, but provides no exploit details, patch information, or evidence of active use.
8 of 8 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | parseplatform | parse-server | - | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |