Live › vulnerability › CVE-2026-86018
Go to dashboardPart-DB, an inventory system for electronic components, has a server-side 'Download external file' attachment feature that streams remote files to disk without checking MAX_ATTACHMENT_FILE_SIZE. An authenticated user who can create or edit attachments can fill the server's disk and cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Instances running Part-DB before 2.13.2 where server-side external file downloads for attachments are enabled. Users must hold an account that can create or edit attachments. Instances with server-side downloads disabled, or that are already on 2.13.2 or later, are not affected.
No product ranges from the sources yet.
2.13.2.MAX_ATTACHMENT_FILE_SIZE and whether server-side external attachment downloads are enabled in the configuration.2.13.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-86018")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.