CVE-2026-59188: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Part-DB Part-DB-server

Part-DB-server, an open source inventory management system, improperly sanitizes SVG files by checking only the user-controlled filename extension instead of the actual file content type. This flaw allows an authenticated attacker to upload a malicious SVG file containing JavaScript payloads with a non-SVG extension (e.g., .jpg), bypassing sanitization. When any user views the attachment inline, the browser interprets the file as image/svg+xml and executes the embedded script within the Part-DB origin, leading to a cross-site scripting vulnerability. The issue is resolved in Part-DB-server version 2.12.3.

An authenticated attacker can upload malicious SVG files that execute arbitrary JavaScript in the context of the Part-DB origin when viewed by any user. This can lead to partial confidentiality and integrity impacts (e.g., theft of user data or session tokens, manipulation of page content) but does not affect availability. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality and integrity.

Upgrade Part-DB-server to version 2.12.3 or later, where the vulnerability is patched. This update corrects the sanitization process to properly validate SVG file content rather than relying on file extensions. No other mitigations are specified or required once the patch is applied.