CVE-2026-86020: CWE-20: Improper Input Validation in Part-DB Part-DB-server

CVE-2026-86020 describes an improper input validation vulnerability (CWE-20) in Part-DB-server before version 2.13.2. The flaw arises because the application does not neutralize spreadsheet formula characters when exporting user-imported CSV data to XLSX format using PhpSpreadsheet's setCellValue() method. An authenticated user with import permissions can inject formula expressions (e.g., =1+1) into part fields. When these parts are exported, the formulas remain executable in the XLSX file, potentially causing unintended formula execution upon opening by other users. This vulnerability has been addressed in Part-DB-server version 2.13.2.

The vulnerability allows an authenticated user with import permissions to inject spreadsheet formulas into exported XLSX files. When other users open these files, the formulas may be executed by their spreadsheet software, potentially leading to information disclosure or other impacts related to formula execution. The CVSS score is 4.6 (medium severity), indicating limited impact primarily on confidentiality and integrity with no availability impact.

This vulnerability is fixed in Part-DB-server version 2.13.2. Users should upgrade to version 2.13.2 or later to remediate this issue. No additional mitigation is required once the patch is applied.