CVE-2026-54615— Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)
Quick assessment
Affected
Part-DB Part-DB-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Part-DB 是一款用于电子元器件的开源库存管理系统。在版本 2.12.1 之前，LogEntryExtraFormatter 负责构建活动日志表（/log）中“附加信息”列以及元件历史表中所显示的 HTML 内容。LogEntryExtraFormatter::getInternalFormat() 方法中的每一个分支都会对用户可控的字符串调用 htmlspecialchars() 进行转义，再将其插入到返回的 HTML 中——唯独 CollectionElementDeleted 分支例外：该分支将 getO
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Part-DB | Part-DB-server | < 2.12.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54615
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)
Source: CVE Program / CVE List V5
Vulnerability Description
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns — except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element — a part Parameter, Attachment, PartLot, Orderdetail, etc. — all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged victim (an administrator/auditor with system.show_logs, or any user viewing that element's history). This is a stored cross-site-scripting / HTML-injection defect caused by a single missed sanitizer in one sibling branch. CSP policies block inline javascript execution under normal conditions. This issue has been patched in version 2.12.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Part-DB | Part-DB-server | < 2.12.1 | - |
|
II. Public POCs for CVE-2026-54615
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54615
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-54615 (1)
Vendor Pages for CVE-2026-54615 (1)
-
🔗 Release Part-DB 2.12.1 · Part-DB/Part-DB-server · GitHub x_refsource_MISC
Same Patch Batch · Part-DB · 2026-10-23 · 9 CVEs total
| CVE-2026-54630 | 9.6 CRITICAL | Part-DB: Authenticated RCE via .phar attachment upload served from public/media |
| CVE-2026-86055 | 8.7 HIGH | Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authenticati |
| CVE-2026-54631 | 6.3 MEDIUM | Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie |
| CVE-2026-55600 | 5.7 MEDIUM | Part-DB: Stored HTML injection in BOM validation results via unescaped Part name |
| CVE-2026-59188 | 5.4 MEDIUM | Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment |
| CVE-2026-86018 | 5.3 MEDIUM | Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads |
| CVE-2026-86019 | 5.3 MEDIUM | Part-DB: Attachment Size Limit Bypass via API Base64 Upload |
| CVE-2026-86020 | 4.6 MEDIUM | Part-DB: Spreadsheet Formula Injection in XLSX Part Exports |
IV. Related Vulnerabilities
Same product: Part-DB-server
-
CVE-2026-86055
Part-DB: Password Reset Link Poisoning via Host Header Injec -
CVE-2026-86020
Part-DB: Spreadsheet Formula Injection in XLSX Part Exports -
CVE-2026-86019
Part-DB: Attachment Size Limit Bypass via API Base64 Upload -
CVE-2026-86018
Part-DB: Authenticated Disk Exhaustion via Unbounded Server- -
CVE-2026-59188
Part-DB: SVG Sanitization Bypass via Extension Spoofing Lead
Same vendor: Part-DB
-
CVE-2026-86055
Part-DB: Password Reset Link Poisoning via Host Header Injec -
CVE-2026-86020
Part-DB: Spreadsheet Formula Injection in XLSX Part Exports -
CVE-2026-86019
Part-DB: Attachment Size Limit Bypass via API Base64 Upload -
CVE-2026-86018
Part-DB: Authenticated Disk Exhaustion via Unbounded Server- -
CVE-2026-59188
Part-DB: SVG Sanitization Bypass via Extension Spoofing Lead
Same weakness: CWE-79
-
CVE-2026-115897
Serialize JavaScript: Cross-site scripting (XSS) via unescap -
CVE-2026-87901
注册模块不当清理导致反射型跨站脚本漏洞 -
CVE-2026-102786
Joomla Extension - phoca.cz - Authenticated stored cross-sit -
CVE-2026-55486
Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — C -
CVE-2026-112333
GFI Archiver < 15.14 Stored XSS via MailInsights.aspx
V. Comments for CVE-2026-54615
No comments yet