Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-59188— Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer

Quick assessment

Affected
Part-DB Part-DB-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Part-DB 是一款用于电子元器件的开源库存管理系统。在 2.12.3 版本之前，Part-DB-server 仅依据用户可控的文件扩展名（而非实际文件内容类型）对 SVG 文件进行清理。已认证的攻击者可上传带有 JavaScript 载荷的恶意 SVG 文件，并通过使用非 SVG 扩展名（例如 .jpg）完全绕过清理机制。当任何用户以嵌入方式查看该附件时，浏览器会接收到 响应头，并在 Part-DB 的源上下文中执行嵌入的脚本。该问题已在 2.12.3 版本中修复。

CVSS 5.4 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59188

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer
Source: CVE Program / CVE List V5
Vulnerability Description
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin. This issue has been patched in version 2.12.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Part-DB Part-DB-server < 2.12.3 -

II. Public POCs for CVE-2026-59188

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-59188

请登录查看更多情报信息。

Other References for CVE-2026-59188 (2)

Same Patch Batch · Part-DB · 2026-10-23 · 9 CVEs total

CVE-2026-54630 9.6 CRITICAL Part-DB: Authenticated RCE via .phar attachment upload served from public/media
CVE-2026-86055 8.7 HIGH Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authenticati
CVE-2026-54631 6.3 MEDIUM Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie
CVE-2026-54615 6.0 MEDIUM Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized Collecti
CVE-2026-55600 5.7 MEDIUM Part-DB: Stored HTML injection in BOM validation results via unescaped Part name
CVE-2026-86018 5.3 MEDIUM Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads
CVE-2026-86019 5.3 MEDIUM Part-DB: Attachment Size Limit Bypass via API Base64 Upload
CVE-2026-86020 4.6 MEDIUM Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

IV. Related Vulnerabilities

Same product: Part-DB-server
Same vendor: Part-DB
Same weakness: CWE-79

V. Comments for CVE-2026-59188

No comments yet

Leave a comment