{"id":"CVE-2026-54630","kind":"vulnerability","aliases":["CVE-2026-54630"],"related":[],"title":"Part-DB: attachment upload lets a logged-in user run PHP code","description":"Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1.","summary":"Part-DB, an inventory system for electronic parts, accepts uploaded .phar files without blocking them and stores them in the public media folder. An authenticated user in the default users group can upload a .phar attachment and request it to execute arbitrary PHP as the web server user.","severity":"critical","cvss":9.6,"epss":0.00234,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache","docker","package","part-db","php","self-hosted"],"not_affected_if":["non-apache-webserver-without-phar-routing","version-2.12.1-or-later"],"how_to_check":"Check the Part-DB version (must be below 2.12.1 to be affected) and confirm Apache routes .phar to PHP-FPM; unknown whether the sources give a specific command.","fix":"Upgrade Part-DB to 2.12.1 or later. Until then, block .phar uploads or deny execution under /media/ in the web server config.","status":"open","published_at":"2026-10-23T04:18:17+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:36+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:31:36Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Part-DB to 2.12.1 or later. Until then, block .phar uploads or deny execution under /media/ in the web server config.","reach":"internet","title":"Part-DB: attachment upload lets a logged-in user run PHP code","impact":"high","summary":"Part-DB, an inventory system for electronic parts, accepts uploaded .phar files without blocking them and stores them in the public media folder. An authenticated user in the default users group can upload a .phar attachment and request it to execute arbitrary PHP as the web server user.","category":"package","who_cares":["part-db","php","self-hosted","docker","apache"],"confidence":0.8,"needs_auth":"yes","worst_case":"Code runs as the web server user on the host, readable secrets exposed","analyst_note":"","how_to_check":"Check the Part-DB version (must be below 2.12.1 to be affected) and confirm Apache routes .phar to PHP-FPM; unknown whether the sources give a specific command.","needs_analyst":false,"not_affected_if":["version-2.12.1-or-later","non-apache-webserver-without-phar-routing"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000534,"input_tokens":3218,"output_tokens":425,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-54630':17A,20A '/media':258C '2.12.1':96C,291C 'abil':269C 'absent':145C 'accept':40B 'admin':219C 'apach':21B,167C,172C 'arbitrari':73B,260C 'attach':4A,67B,99C,157C,193C,229C,235C,250C 'attachmentsubmithandl':127C 'authent':56B,240C 'block':45B,213C 'blocklist':122C 'cgi':135C 'client':115C 'client-suppli':114C 'code':14A 'compon':92C 'config':276C 'configur':173C 'consult':204C 'contain':279C 'creat':227C 'cve':15A,18A 'danger':130C 'data':266C 'db':3A,26B,33B,82C 'default':60B,159C,200C,223C,244C,283C 'depend':272C 'directori':111C 'docker':22B,277C 'document':168C 'electron':38B,91C 'empti':198C 'execut':72B,185C,259C 'exploit':271C 'extens':118C,121C,131C,155C,195C 'fetch':255C 'file':43B,104C,117C,152C,183C,236C 'filter':196C,233C 'folder':54B 'fpm':179C 'group':62B,225C,246C 'handler':101C,208C 'host':30B 'htaccess':139C 'html':138C 'imag':278C 'includ':125C 'inventori':35B,87C 'issu':285C 'js':137C 'keep':153C 'let':6A 'list':148C 'log':9A 'logged-in':8A 'manag':88C 'media':53B,110C 'non':218C 'non-admin':217C 'open':85C 'packag':23B 'part':2A,25B,32B,39B,81C,98C,238C,253C 'part-db':1A,24B,31B,80C 'patch':288C 'per':192C 'per-attachment-typ':191C 'phar':42B,66B,126C,143C,151C,175C,249C 'php':13A,27B,74B,132C,178C,187C,261C 'php-fpm':177C 'phtml':133C 'prior':93C 'public':52B,156C 'public/media':163C 'py':136C 'renameblacklistedextens':128C 'request':69B,189C 'rewrit':129C 'root':169C 'rout':174C 'run':12A 'self':29B 'self-host':28B 'serv':109C 'server':78B 'sh':134C 'ship':171C 'sourc':86C 'store':48B,102C,182C 'suppli':116C 'system':36B,89C 'txt':141C 'type':194C,230C 'upload':5A,41B,64B,100C,103C,207C,247C 'use':112C 'user':11A,57B,61B,79B,220C,224C,241C,245C,268C 'version':95C,290C 'vulner':281C 'way':211C 'web':77B,108C,267C 'web-serv':107C 'webserv':275C 'without':44B 'written':161C 'www':265C 'www-data':264C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T04:18:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54630","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54630","severity":null,"published_at":"2026-10-23T04:18:17+00:00","modified_at":"2026-10-23T19:36:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-54630","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54630","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}