CVE-2025-55194: Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload
Vulnerability summary
CVE-2025-55194 is a medium (CVSS 5.7) Uncaught Exception vulnerability in part-db_project part-db. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.7% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 13-08-2025PublishedVulnerability first disclosed.
- 14-08-2025Last modifiedVulnerability information updated.
Description
Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Error when attempting to view or edit that user’s profile. This makes the profile permanently inaccessible via the UI for both users and administrators, constituting a Denial of Service (DoS) within the user management interface. This issue has been patched in version 1.17.3.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.7MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.37%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.36% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundPart Db Server
Maturity: poc
Exploit Reference (drive.google.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Part-db1 product
- part-db-server< 1.17.3
Part-db_project1 product
- part-db< 1.17.3
2 vendors · 2 products
References
3 links- github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69wwX Refsource CONFIRMExploitThird Party Advisory
- github.com/Part-DB/Part-DB-server/commit/d370f976a7b0c19d502aadbaa0f93eb90c2a6ffaX Refsource MISCPatch