CVE-2026-86018Medium· 5.3▾ SunlitPart-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download exter…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.
Part-DB-server < 2.13.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86019Medium· 5.3Part-DB: Attachment Size Limit Bypass via API Base64 Upload
CVE-2026-86020Medium· 4.6Part-DB: Spreadsheet Formula Injection in XLSX Part Exports
CVE-2026-59188Medium· 5.4Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer
CVE-2026-86055High· 8.7Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover
CVE-2026-54630Critical· 9.6Part-DB: Authenticated RCE via .phar attachment upload served from public/media
CVE-2026-54615Medium· 6.0Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)