{"action":"Upgrade parse-server to 7.5.4 or later.","affected":[{"fixed":"7.5.4","introduced":"4.2.0"},{"fixed":"8.4.0-alpha.2","introduced":"8.0.0"}],"component":"parse-server","cve_ids":["CVE-2025-64430"],"ecosystem":"npm","epss":0.00645,"exploited":false,"fixed_versions":["7.5.4","8.4.0-alpha.2"],"ghsa_id":"GHSA-x4qj-2f4q-r4rx","id":"tcs_01M5KGGWP5E3C8EPEH1M6P1EA6","modified_at":"2025-11-12T12:27:52.680028Z","published_at":"2025-11-05T19:52:27Z","references":["https://osv.dev/vulnerability/GHSA-x4qj-2f4q-r4rx","https://github.com/parse-community/parse-server/security/advisories/GHSA-x4qj-2f4q-r4rx","https://nvd.nist.gov/vuln/detail/CVE-2025-64430","https://github.com/parse-community/parse-server/pull/9903","https://github.com/parse-community/parse-server/pull/9904","https://github.com/parse-community/parse-server/commit/8bbe3efbcf4a3b66f4a8db9bfb18cd98c050db51","https://github.com/parse-community/parse-server/commit/97763863b72689a29ad7a311dfb590c3e3c50585","https://github.com/parse-community/parse-server"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-x4qj-2f4q-r4rx","url":"https://osv.dev/vulnerability/GHSA-x4qj-2f4q-r4rx"}],"summary":"Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format"}