CVE-2026-86018Medium· 5.3▾ TwilightPoC availablePart-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download exter…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Last analysed / modified upstream
0.3% → 0.4%
Exploit / PoC code exists
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.
Part-DB-server < 2.13.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86019Medium· 5.3Part-DB: Attachment Size Limit Bypass via API Base64 Upload
CVE-2026-86020Medium· 4.6Part-DB: Spreadsheet Formula Injection in XLSX Part Exports
CVE-2026-59188Medium· 5.4Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer
CVE-2026-86055High· 8.7Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover
CVE-2026-54630Critical· 9.6Part-DB: Authenticated RCE via .phar attachment upload served from public/media
CVE-2026-54631Medium· 6.3Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie