File Size Validation Bypass in Part-DB by Open Source Vendor
CVE-2026-86019

5.3MEDIUM

Key Information:

Vendor

Part-db

Status
Part-db-server
Vendor
CVE Published:
23 October 2026

What is CVE-2026-86019?

Part-DB, an open source inventory management system for electronic components, prior to version 2.13.2, contains a flaw that allows authenticated API users to bypass the maximum attachment file size limit. This occurs when users upload attachments encoded in base64 through the API, which fail to enforce the same size restrictions that are applied to regular browser-based uploads. This oversight may enable an authenticated user with appropriate permissions to upload excessively large files, potentially resulting in a denial of service by exhausting available disk space. The issue has been addressed in version 2.13.2.

Affected Version(s)

Part-DB-server < 2.13.2

References

https://github.com/Part-DB/Part-DB-server/security/adviso...
x_refsource_CONFIRM
https://github.com/Part-DB/Part-DB-server/releases/tag/v2...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.