{"id":"CVE-2026-59188","kind":"vulnerability","aliases":["CVE-2026-59188"],"related":[],"title":"Part-DB: uploaded SVG with script runs in users' browsers","description":"Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin. This issue has been patched in version 2.12.3.","summary":"Part-DB, an open source electronic component inventory system, decides whether to sanitize an uploaded SVG by its file extension rather than its content. An authenticated user can upload an SVG renamed to .jpg, and when another user views it inline the embedded script runs in the Part-DB origin.","severity":"medium","cvss":5.4,"epss":0.0015,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["inventory","package","part-db","php","self-hosted"],"not_affected_if":["no-user-uploads","patched-2.12.3-or-later","single-trusted-user"],"how_to_check":"- Check the installed Part-DB version: `composer show` in the Part-DB install directory or the version shown in the admin panel; versions below `2.12.3` are affected.\n- unknown for whether attachments were already uploaded with non-SVG extensions.","fix":"- Upgrade Part-DB-server to `2.12.3` or later.","status":"open","published_at":"2026-10-23T05:17:17+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:14:14+00:00","updated_at":"2026-10-25T04:14:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:14:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Part-DB-server to `2.12.3` or later.","reach":"internet","title":"Part-DB: uploaded SVG with script runs in users' browsers","impact":"medium","summary":"Part-DB, an open source electronic component inventory system, decides whether to sanitize an uploaded SVG by its file extension rather than its content. An authenticated user can upload an SVG renamed to .jpg, and when another user views it inline the embedded script runs in the Part-DB origin.","category":"package","nicknames":[],"who_cares":["part-db","self-hosted","inventory","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"script runs in other users' sessions in the Part-DB origin","analyst_note":"","how_to_check":"- Check the installed Part-DB version: `composer show` in the Part-DB install directory or the version shown in the admin panel; versions below `2.12.3` are affected.\n- unknown for whether attachments were already uploaded with non-SVG extensions.","needs_analyst":false,"not_affected_if":["patched-2.12.3-or-later","no-user-uploads","single-trusted-user"],"who_is_affected":"Self-hosted Part-DB instances below `2.12.3` where users can upload attachments and other users view them. The attacker needs a valid account that can upload attachments. Instances with no untrusted user accounts are at much lower risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000602,"input_tokens":3430,"output_tokens":518,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-59188':14A,17A '2.12.3':95C,173C 'actual':114C 'anoth':64B 'attach':145C 'attack':120C 'authent':53B,119C 'base':103C 'browser':11A,148C 'bypass':137C 'compon':34B,91C 'content':51B,116C,151C 'content-typ':150C 'control':109C 'cve':12A,15A 'db':3A,22B,29B,77B,81C,98C,164C 'decid':37B 'e.g':135C 'electron':33B,90C 'embed':70B,158C 'entir':139C 'execut':156C 'extens':47B,111C,134C 'file':46B,102C,115C 'filenam':110C 'host':26B 'image/svg':153C 'inlin':68B,146C 'inventori':18B,35B,86C 'issu':167C 'javascript':127C 'jpg':61B,136C 'malici':124C 'manag':87C 'non':132C 'non-svg':131C 'open':31B,84C 'origin':78B,165C 'packag':19B 'part':2A,21B,28B,76B,80C,97C,163C 'part-db':1A,20B,27B,75B,79C,162C 'part-db-serv':96C 'patch':170C 'payload':128C 'php':23B 'prior':92C 'rather':48B,112C 'receiv':149C 'renam':59B 'run':8A,72B 'sanit':40B,100C,138C 'script':7A,71B,159C 'self':25B 'self-host':24B 'server':99C 'sole':104C 'sourc':32B,85C 'svg':5A,43B,58B,101C,125C,133C 'system':36B,88C 'type':117C,152C 'upload':4A,42B,56B,122C 'use':129C 'user':10A,54B,65B,108C,142C 'user-control':107C 'version':94C,172C 'view':66B,143C 'whether':38B 'xml':154C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Part-DB instances below `2.12.3` where users can upload attachments and other users view them. The attacker needs a valid account that can upload attachments. Instances with no untrusted user accounts are at much lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T05:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59188","severity":null,"published_at":"2026-10-23T05:17:17+00:00","modified_at":"2026-10-23T19:36:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-59188","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59188","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}