CVE-2025-64430

Description

### Impact A Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality when trying to upload a `Parse.File` with `uri` parameter allows to execute an arbitrary URI. The vulnerability stems from a file upload feature in which Parse Server retrieves the file data from a URI that is provided in the request. A request to the provided URI is executed, but the response is not stored in Parse Server's file storage as the server crashes upon receiving the response. ### Patches The feature has been implemented in Parse Server 4.2.0 but never worked and reliably crashes the server when trying to use it due to a bug in its implementation. Since the feature is not currently working, and due to its risky nature, it has been removed to address the vulnerability. ### Workarounds None.

How to fix CVE-2025-64430

To remediate CVE-2025-64430, upgrade the affected package to a fixed version below.

• —upgrade to 7.5.4 or later
• —upgrade to 7.5.4 or later

Is CVE-2025-64430 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• >= 4.2.0, < 7.5.4, >= 8.0.0, < 8.4.0
• >= 4.2.0, < 7.5.4

CVSS scores

References (7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-64430
• PATCHgithub.com/parse-community/parse-server
• WEBgithub.com/parse-community/parse-server/commit/8bbe3efbcf4a3b66f4a8db9bfb18cd98c050db51
• WEBgithub.com/parse-community/parse-server/commit/97763863b72689a29ad7a311dfb590c3e3c50585