Live › vulnerability › CVE-2026-86019
Go to dashboardPart-DB, an open source electronic component inventory system, lets an authenticated API user upload attachments via base64 data without the configured maximum size check applied to browser uploads. An attacker can fill the server's disk with oversized files, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Instances running Part-DB before 2.13.2 that expose the API to users with permission to create attachments. Instances with no API access or where only trusted staff hold attachment-create rights are at lower risk.
No product ranges from the sources yet.
2.13.2 are affected.2.13.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces the configured attachment size limit for normal browser-based file uploads, but the API base64 upload path does not apply the same size validation. As a result, an authenticated user with API access and permission to create attachments can upload files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-86019")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.