SVG File Handling Vulnerability in Part-DB Inventory Management System
CVE-2026-59188

5.4MEDIUM

Key Information:

Vendor

Part-db

Status
Part-db-server
Vendor
CVE Published:
23 October 2026

What is CVE-2026-59188?

Part-DB, an open-source inventory management system for electronic components, was found to have a security misconfiguration in its handling of SVG file uploads. Prior to version 2.12.3, the system relied solely on the user-controlled filename extension for sanitization, allowing an authenticated attacker to upload a malicious SVG file with a misleading extension (such as .jpg). This flaw enabled the attacker to bypass the intended security measures completely. When other users viewed the attachment, the system incorrectly identified the file as an image, resulting in execution of an embedded JavaScript payload. The vulnerability was resolved in version 2.12.3, which enhanced file content validation to mitigate this risk.

Affected Version(s)

Part-DB-server < 2.12.3

References

https://github.com/Part-DB/Part-DB-server/security/adviso...
x_refsource_CONFIRM
https://github.com/Part-DB/Part-DB-server/releases/tag/v2...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.