CVE-2026-86018: falha de média gravidade em Part-DB-server
Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
Part-DB · Part-DB-serverCVEs relacionadas — Part-DB-server
No mesmo produto, das mais perigosas para as menos.
CVE-2026-86055HIGHPart-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account TakeoverEPSS 0.6%CVE-2023-26042MEDIUMHTML/XSS injection possibilities in Part-DB EPSS 0.5%CVE-2026-55600MEDIUMPart-DB: Stored HTML injection in BOM validation results via unescaped Part nameEPSS 0.4%CVE-2025-55194MEDIUMPart-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar UploadEPSS 0.4%CVE-2026-54615MEDIUMPart-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)EPSS 0.4%CVE-2026-86019MEDIUMPart-DB: Attachment Size Limit Bypass via API Base64 UploadEPSS 0.4%