CVE-2026-54630
CRITICAL 9.6Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1.
Severe if exploited (CVSS 9.6), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 14th percentile
Impact if exploited
9.6CVSS 3.1 · CRITICAL
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-434: : Unrestricted Upload of File with Dangerous Type
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
References and research data (JSON)
All CVSS metrics
- CRITICAL 9.6 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - CRITICAL 9.6 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
References
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108573 EUVD · EUVD-2026-108573
Technical & other
- https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-w5m7-3xf7-6g7g CVE record · GitHub_M · Updated 2026-10-23T03:48:59.951Z
NVD · CVE-2026-54630 · Updated 2026-10-23T19:36:32.410 - https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1 CVE record · GitHub_M · Updated 2026-10-23T03:48:59.951Z
NVD · CVE-2026-54630 · Updated 2026-10-23T19:36:32.410