AIKIDO-2026-11108

TL;DR

Parse Server's file upload extension blocklist can be bypassed with a filename that ends in a trailing dot, such as poc.svg., which makes the extension parser return an empty string and skip validation. When the storage adapter persists the attacker-supplied Content-Type header, the file is later served with an active MIME type like image/svg+xml, enabling stored cross-site scripting. Exploitation requires an authenticated uploader and a victim who opens the served file. The fix treats trailing-dot filenames as extensionless and validates the Content-Type subtype against the blocklist instead.