Threat Intelligence Database

Part-DB-server versions prior to 2.13.3 contain a vulnerability in the password recovery mechanism where the reset link URL is constructed from an unvalidated client-supplied Host header. This allows an unauthenticated attacker to craft a password reset email with a malicious hostname embedding a valid reset token. When the victim clicks the link, the attacker can capture the token and use it to reset the victim's password, including the seeded admin account, resulting in full administrative takeover. The issue is patched in version 2.13.3.

Part-DB-server versions prior to 2.13.2 contain a spreadsheet formula injection vulnerability in the part import/export workflow. Authenticated users with import permissions can include formula-prefixed values in CSV imports, which are then exported as executable spreadsheet formulas in XLSX files. This can lead to formula execution when the exported spreadsheet is opened by another user. The issue is patched in version 2.13.2.

Part-DB-server versions prior to 2.13.2 contain a vulnerability where authenticated API users can bypass the configured maximum attachment file size by uploading base64-encoded files through the API. This bypass allows uploading files larger than the intended limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.

Part-DB-server versions prior to 2.13.2 contain a vulnerability that allows authenticated users to bypass the maximum attachment file size limit when using the server-side 'Download external file' feature. This can lead to uncontrolled resource consumption by storing files larger than the configured limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.

Part-DB-server versions prior to 2.12.3 contain a cross-site scripting (XSS) vulnerability due to improper sanitization of SVG files. The server relies on the file extension rather than actual content type to sanitize SVG uploads, allowing authenticated attackers to upload malicious SVG files with JavaScript payloads using non-SVG extensions. When users view these attachments inline, the embedded script executes in the context of the Part-DB origin. This vulnerability has been fixed in version 2.12.3.

Part-DB-server versions prior to 2.12.2 contain a stored cross-site scripting (XSS) vulnerability. This occurs because user-controlled Part names are rendered using Twig's |raw filter without proper neutralization, allowing injection of arbitrary HTML elements into the BOM validation result page. Although JavaScript execution is blocked by the Content Security Policy, attackers can still inject HTML links, forms, images, and CSS UI elements. The vulnerability is fixed in version 2.12.2.

Part-DB-server versions prior to 2.12.1 contain a hard-coded APP_SECRET value in the .env file committed to the public repository. This secret is used by the Symfony framework to sign remember-me cookies. Because the official Docker image does not override or randomize this secret at startup, an attacker who obtains it can forge authenticated sessions without credentials. This vulnerability has been fixed in version 2.12.1.

CVE-2026-54630 is a critical vulnerability in Part-DB-server prior to version 2.12.1 that allows authenticated users with default user privileges to upload .phar files to a web-accessible directory. The upload handler fails to block .phar extensions, which are executed as PHP due to the default Apache configuration routing .phar files to PHP-FPM. This leads to remote code execution as the web server user. The issue is patched in version 2.12.1.

Part-DB-server versions prior to 2.12.1 contain a stored cross-site scripting (XSS) vulnerability in the LogEntryExtraFormatter component. This occurs because one code path fails to properly escape user-controlled input when generating HTML for activity logs and element history tables. A low-privileged user can exploit this by embedding malicious HTML or script in the name of a deleted collection sub-element, which is then rendered as raw HTML in the browser of higher-privileged users viewing logs or history. The vulnerability has been patched in version 2.12.1. Content Security Policy (CSP) mitigates inline script execution under normal conditions.