IT SBIT Services
Schneeberger
DEEN
CVE tracker

Part-DB Server: Remote code execution via .phar attachment upload

CVE-2026-54630Critical 9.6

← All vulnerabilities

Summary

Part-DB, an open source inventory system for electronic components, stores uploaded part attachments in the web-served media directory. The extension blocklist does not include .phar, so a PHP file uploaded with that extension is kept and executed by PHP-FPM when requested under /media/. Any authenticated user in the default users group can exploit this to run arbitrary PHP as the web server user www-data, which gives access to the application database and its data. The CNA rates it as critical (CVSS 9.6).

Affected

  • Part-DB-server versions before 2.12.1 (the advisory tested v2.12.0)
  • Docker images based on the official jbtronics/part-db1 image in default configuration

Fixed in

  • Part-DB-server 2.12.1 or later

Workaround

  • Unknown. No vendor workaround is documented.
  • Possible interim measure (not from the vendor): stop PHP execution under /media/ and remove the .phar mapping to PHP-FPM. Verify this against your own Apache and PHP-FPM setup first.

Exploitation

  • The vendor confirmed exploitation in a lab test on the default Docker configuration.
  • CISA SSVC lists exploitation as PoC and automatable as no.
  • No reports of active exploitation and no public proof-of-concept code were found at the time of research.

Our recommendation

  • Upgrade to Part-DB-server 2.12.1 or later and rebuild Docker images from fixed sources.
  • Change the APP_SECRET value as described in the 2.12.1 release notes.
  • Search the media directory for .phar and other PHP files and review them.
  • Review which users can edit parts and create attachment types, and limit these rights.
  • Restrict access to Part-DB if it is reachable from the internet.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:10.

Original description (NVD)

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed