Vulnerabilities/CVE-2026-59188

CVE-2026-59188: Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer

SSVC · Estimated by CveMateTrackHandle in routine patching. CISA has no entry yet, so CveMate computed this from CVSS and exploit data. It is replaced when CISA publishes.

ExploitationNone (derived)

AutomatableNo (derived)

Technical impactPartial (derived)

Mission & well-beingHigh (assumed)

Source: CveMate estimate, same decision tree as CISA.CISA publishes the first three inputs. Mission & well-being depends on your environment, so it is assumed at its highest: the decision is a worst case.

Received

Published 23-10-2026Last modified 23-10-2026

On this page

Summary Timeline Description CVSS metrics EPSS trend Known exploited Public exploits Weaknesses Affected systems References

Key information

Published23-10-2026

Modified23-10-2026

SourceCVE.org

CVSS5.4

EPSSNot scored

KEV0

Exploits0

Vulnerability summary

CVE-2026-59188 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in part-db part-db-server.

Overall risk

22/100

0100

Low · default modelHow is this calculated?

SSVC · Estimated by CveMateTrackHandle in routine patching. CISA has no entry yet, so CveMate computed this from CVSS and exploit data. It is replaced when CISA publishes.

ExploitationNone (derived)

AutomatableNo (derived)

Technical impactPartial (derived)

Mission & well-beingHigh (assumed)

CVSS score

5.4/10

010

Medium · v3.1 (CVE.org)

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

23-10-2026
PublishedVulnerability first disclosed.

Description

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin. This issue has been patched in version 2.12.3.

CVSS metrics

2 scores · 2 sources · 1 version

v3.15.4

Medium 5.4Preferred score · CVE.org (CNA)

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SourcesAll 2 agree

NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Affected systems

Part-db1 product

part-db-server< 2.12.3

1 vendor · 1 product

References

2 links

github.com/Part-DB/Part-DB-server/security/advisories/GHSA-2vhp-c958-m47jX Refsource CONFIRM
github.com/Part-DB/Part-DB-server/releases/tag/v2.12.3X Refsource MISC

Related vulnerabilities

HighCVE-2026-86055part-db · part-db-server4h agoPart-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account TakeoverPart-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.MediumCVE-2026-86020part-db · part-db-server4h agoPart-DB: Spreadsheet Formula Injection in XLSX Part ExportsPart-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.MediumCVE-2026-86019part-db · part-db-server4h agoPart-DB: Attachment Size Limit Bypass via API Base64 UploadPart-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces the configured attachment size limit for normal browser-based file uploads, but the API base64 upload path does not apply the same size validation. As a result, an authenticated user with API access and permission to create attachments can upload files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.MediumCVE-2026-86018part-db · part-db-server4h agoPart-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment DownloadsPart-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.CriticalCVE-2026-54630part-db · part-db-server4h agoPart-DB: Authenticated RCE via .phar attachment upload served from public/mediaPart-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1.MediumCVE-2026-54615part-db · part-db-server5h agoPart-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns — except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element — a part Parameter, Attachment, PartLot, Orderdetail, etc. — all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged victim (an administrator/auditor with system.show_logs, or any user viewing that element's history). This is a stored cross-site-scripting / HTML-injection defect caused by a single missed sanitizer in one sibling branch. CSP policies block inline javascript execution under normal conditions. This issue has been patched in version 2.12.1.

All vulnerabilities inpart-db-server