Arbitrary Code Execution Vulnerability in Part-DB Inventory Management System by Part-DB

CVE-2026-54630

What is CVE-2026-54630?

Part-DB, an open-source inventory management system for electronic components, contains a vulnerability that allows an attacker to upload malicious files. Specifically, the attachment upload handler neglects to block the .phar file extension from being uploaded, which poses a significant risk. By default, files are stored in the Apache document root, allowing any authenticated user in the default user group to upload a .phar file. This file, when accessed, could execute arbitrary PHP code as the web server's user. The vulnerability arises from the inadequate extension blocklist and misconfigured attachment filters, making it critical for users to update to version 2.12.1, where this issue has been rectified.

References