CVE-2023-46119

Parse Server may crash when uploading file without extension

7.5 HighFix available

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.32%Up 1.3 points since Oct 25, 2023

What each source reports

CVE List Score used 7.5

Parse Server may crash when uploading file without extension

Record: CVE-2023-46119
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-23
Updated: 2026-11-02

EUVDEUVD-2023-2684 7.5

Record: EUVD-2023-2684
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-792q-q67h-w579 7.5

Parse Server may crash when uploading file without extension

Impact

Parse Server crashes when uploading a file without extension.

Patches

A permanent fix has been implemented to prevent the server from crashing.

Workarounds

There are no known workarounds.

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
Patched in Parse Server 6: https://github.com/parse-community/parse-server/releases/tag/6.3.1
Patched in Parse Server 5 (LTS): https://github.com/parse-community/parse-server/releases/tag/5.5.6

Record: GHSA-792q-q67h-w579
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-22, CWE-23
Updated: 2026-11-02

NVD 7.5

Record: CVE-2023-46119
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-23, CWE-22
Updated: 2026-11-02

OSV 7.5

Parse Server may crash when uploading file without extension

Record: CVE-2023-46119
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-23
Updated: 2026-11-02

OSVGHSA-792q-q67h-w579 7.5

Parse Server may crash when uploading file without extension

Impact

Parse Server crashes when uploading a file without extension.

Patches

A permanent fix has been implemented to prevent the server from crashing.

Workarounds

There are no known workarounds.

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
Patched in Parse Server 6: https://github.com/parse-community/parse-server/releases/tag/6.3.1
Patched in Parse Server 5 (LTS): https://github.com/parse-community/parse-server/releases/tag/5.5.6

Record: GHSA-792q-q67h-w579
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-22, CWE-23
Updated: 2026-11-02

OSVBIT-parse-2023-46119 No score

Parse Server may crash when uploading file without extension

Record: BIT-parse-2023-46119
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`parse-server` npm	1.0.0 up to 5.5.6	5.5.6
`parse-server` npm	6.0.0 up to 6.3.1	6.3.1
`parse` Bitnami	1.0.0 up to 5.5.6, 6.0.0 up to 6.3.1	5.5.66.3.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-46119 is a high vulnerability (CVSS 7.5) in Parse Community Server, published October 24, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 70th percentile. Fixed in parse-server 5.5.6.