Live › vulnerability › CVE-2026-59188
Go to dashboardPart-DB, an open source electronic component inventory system, decides whether to sanitize an uploaded SVG by its file extension rather than its content. An authenticated user can upload an SVG renamed to .jpg, and when another user views it inline the embedded script runs in the Part-DB origin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Part-DB instances below 2.12.3 where users can upload attachments and other users view them. The attacker needs a valid account that can upload attachments. Instances with no untrusted user accounts are at much lower risk.
No product ranges from the sources yet.
composer show in the Part-DB install directory or the version shown in the admin panel; versions below 2.12.3 are affected.2.12.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin. This issue has been patched in version 2.12.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-59188")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.