CVE-2026-54630
CriticalCVSS 9.6Summary
In Part-DB before version 2.12.1, the attachment upload handler's dangerous-extension blocklist does not include phar. A .phar file uploaded as an attachment is stored in public/media/ (the Apache document root), and the shipped Apache configuration routes .phar to PHP-FPM, allowing execution of arbitrary PHP.
Risk Assessment
An authenticated user in the default users group can upload a malicious .phar attachment and achieve code execution as the www-data web user, potentially leading to server compromise.
Recommendation
Upgrade Part-DB to version 2.12.1 or later, and consider removing .phar from handled extensions in the Apache/PHP-FPM configuration.
Other vulnerabilities in Part-DB
See all- CVE-2026-55600Medium
In Part-DB before version 2.12.2, BOM validation messages are rendered using Twig's |raw filter and include translated placeholders populated with user-controlled Part names. A user who can edit a Part name can store HTML markup that is rendered in another user's BOM validation result page, resulting in cross-user stored HTML injection.
- CVE-2026-54631Medium
In Part-DB before version 2.12.1, the committed .env file contains a fixed APP_SECRET value that the official jbtronics/part-db1 Docker image does not override or randomize at container start-up. Since Symfony uses APP_SECRET as the HMAC key for signing remember-me cookies, an attacker who knows the secret can forge an arbitrary-user remember-me cookie and gain a fully authenticated session without credentials.
- CVE-2026-54615Medium
Part-DB, an open source inventory management system for electronic components, prior to version 2.12.1 contains a stored XSS vulnerability. The LogEntryExtraFormatter class in the CollectionElementDeleted branch interpolates getOldName() and getCollectionName() into HTML without htmlspecialchars(), allowing a low-privileged content editor to store an HTML/script payload as the name of a sub-element and have it executed in the browser of a higher-privileged victim viewing the activity log or element history.
Original NVD description (English source)
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS