CVE-2026-59188Medium· 5.4▾ SunlitPart-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin. This issue has been patched in version 2.12.3.
Part-DB-server < 2.12.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54630Critical· 9.6Part-DB: Authenticated RCE via .phar attachment upload served from public/media
CVE-2026-54615Medium· 6.0Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)
CVE-2026-55600Medium· 5.7Part-DB: Stored HTML injection in BOM validation results via unescaped Part name
CVE-2026-86018Medium· 5.3Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads
CVE-2026-86019Medium· 5.3Part-DB: Attachment Size Limit Bypass via API Base64 Upload
CVE-2026-86055High· 8.7Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover