{"id":"CVE-2026-86018","kind":"vulnerability","aliases":["CVE-2026-86018"],"related":[],"title":"Part-DB: external file download skips attachment size limit, enabling disk exhaustion","description":"Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.","summary":"Part-DB, an inventory system for electronic components, has a server-side 'Download external file' attachment feature that streams remote files to disk without checking MAX_ATTACHMENT_FILE_SIZE. An authenticated user who can create or edit attachments can fill the server's disk and cause a denial of service.","severity":"medium","cvss":5.3,"epss":0.00272,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","part-db","php","self-hosted"],"not_affected_if":["no-untrusted-accounts","server-side-downloads-disabled","version-2.13.2-or-later"],"how_to_check":"- Check the installed Part-DB version and compare it with `2.13.2`.\n- Look for `MAX_ATTACHMENT_FILE_SIZE` and whether server-side external attachment downloads are enabled in the configuration.","fix":"- Upgrade Part-DB to `2.13.2` or later.","status":"open","published_at":"2026-10-23T05:17:18+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:19:00+00:00","updated_at":"2026-10-25T04:19:00+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:19:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Part-DB to `2.13.2` or later.","reach":"internet","title":"Part-DB: external file download skips attachment size limit, enabling disk exhaustion","impact":"medium","summary":"Part-DB, an inventory system for electronic components, has a server-side 'Download external file' attachment feature that streams remote files to disk without checking MAX_ATTACHMENT_FILE_SIZE. An authenticated user who can create or edit attachments can fill the server's disk and cause a denial of service.","category":"package","nicknames":[],"who_cares":["part-db","self-hosted","php"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authenticated user fills server disk, causing denial of service.","analyst_note":"","how_to_check":"- Check the installed Part-DB version and compare it with `2.13.2`.\n- Look for `MAX_ATTACHMENT_FILE_SIZE` and whether server-side external attachment downloads are enabled in the configuration.","needs_analyst":false,"not_affected_if":["version-2.13.2-or-later","server-side-downloads-disabled","no-untrusted-accounts"],"who_is_affected":"Instances running Part-DB before 2.13.2 where server-side external file downloads for attachments are enabled. Users must hold an account that can create or edit attachments. Instances with server-side downloads disabled, or that are already on 2.13.2 or later, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3463,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-86018':16A,19A '2.13.2':96C,196C 'allow':100C 'attach':8A,45B,56B,67B,108C,120C,126C,148C,163C,177C 'authent':60B,101C,156C 'bypass':104C 'caus':75B,165C,184C 'check':54B 'compon':36B,92C 'configur':106C,146C,175C 'creat':64B,160C 'cve':14A,17A 'db':3A,23B,30B,82C,99C,132C,168C 'denial':77B,186C 'direct':140C 'disk':12A,52B,73B,142C,181C 'download':6A,42B,117C,127C,133C 'edit':66B,162C 'electron':35B,91C 'enabl':11A,129C 'enforc':144C 'exhaust':13A,180C 'extern':4A,43B,118C 'featur':46B,121C 'file':5A,44B,50B,57B,109C,119C,136C,149C,171C 'fill':69B 'host':27B 'inventori':32B,87C 'issu':190C 'larger':172C 'limit':10A,151C 'manag':88C 'max':55B,147C 'maximum':107C,176C 'open':85C 'packag':20B 'part':2A,22B,29B,81C,98C,131C,167C 'part-db':1A,21B,28B,80C,97C,130C,166C 'patch':193C 'php':24B 'potenti':179C 'prior':93C 'remot':49B,135C 'result':154C 'self':26B 'self-host':25B 'server':40B,71B,115C,124C 'server-sid':39B,114C,123C 'servic':79B,188C 'side':41B,116C,125C 'size':9A,58B,110C,150C,178C 'skip':7A 'sourc':86C 'space':182C 'store':170C 'stream':48B,138C 'system':33B,89C 'use':112C 'user':61B,102C,157C 'version':95C,195C 'without':53B,143C","nicknames":[],"mitigations":[],"who_affected":"Instances running Part-DB before 2.13.2 where server-side external file downloads for attachments are enabled. Users must hold an account that can create or edit attachments. Instances with server-side downloads disabled, or that are already on 2.13.2 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T05:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86018","severity":null,"published_at":"2026-10-23T05:17:18+00:00","modified_at":"2026-10-23T19:36:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-86018","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86018","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}