---
id: "CVE-2026-54615"
kind: "vulnerability"
aliases: ["CVE-2026-54615"]
title: "Part-DB: stored XSS in activity log via deleted sub-element names"
severity: "medium"
cvss: 6.0
epss: 0.00297
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["inventory", "package", "part-db", "self-hosted"]
not_affected_if: ["patched-2.12.1"]
published_at: "2026-10-23T04:18:16+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:05:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54615", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-54615", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Part-DB: stored XSS in activity log via deleted sub-element names

Part-DB's activity log and element history do not escape the names of deleted collection sub-elements, so HTML inserted by an editor is rendered as live markup. An attacker with edit rights can run script in the browser of an administrator or auditor who views the log, though the content security policy blocks inline script under normal conditions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Part-DB version (`composer show` in the Part-DB directory, or the version shown in the web footer); versions below `2.12.1` are affected.
- Review the instance's content security policy headers for `script-src` restrictions to judge how far the injected markup can go.

## Fix

- Upgrade Part-DB to `2.12.1` or later.
- Until upgraded, restrict edit rights on parts and their sub-elements to trusted users.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54615
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-54615

## From the sources

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns — except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element — a part Parameter, Attachment, PartLot, Orderdetail, etc. — all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged victim (an administrator/auditor with system.show_logs, or any user viewing that element's history). This is a stored cross-site-scripting / HTML-injection defect caused by a single missed sanitizer in one sibling branch. CSP policies block inline javascript execution under normal conditions. This issue has been patched in version 2.12.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_