---
id: "CVE-2026-59188"
kind: "vulnerability"
aliases: ["CVE-2026-59188"]
title: "Part-DB: uploaded SVG with script runs in users' browsers"
severity: "medium"
cvss: 5.4
epss: 0.0015
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["inventory", "package", "part-db", "php", "self-hosted"]
not_affected_if: ["no-user-uploads", "patched-2.12.3-or-later", "single-trusted-user"]
published_at: "2026-10-23T05:17:17+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:14:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59188", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-59188", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Part-DB: uploaded SVG with script runs in users' browsers

Part-DB, an open source electronic component inventory system, decides whether to sanitize an uploaded SVG by its file extension rather than its content. An authenticated user can upload an SVG renamed to .jpg, and when another user views it inline the embedded script runs in the Part-DB origin.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Part-DB version: `composer show` in the Part-DB install directory or the version shown in the admin panel; versions below `2.12.3` are affected.
- unknown for whether attachments were already uploaded with non-SVG extensions.

## Fix

- Upgrade Part-DB-server to `2.12.3` or later.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59188
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-59188

## From the sources

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin. This issue has been patched in version 2.12.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_