Part-DB Server CVE-2026-59188

Requires an authenticated Part-DB account that holds attachment-upload permission; the advisory states even low-privilege users suffice, so no admin access is needed to plant the payload. Exploitation further requires a victim user to open the malicious attachment inline at /attachment/{id}/view - that user interaction is the primary limiting factor, and the payload only affects whoever views it (impact escalates if that viewer is an administrator). No special or non-default configuration is needed: the flaw is in default handling of uploaded attachments in Part-DB-server versions <= 2.12.2, because sanitization is decided by the user-controlled filename extension (e.g. naming an SVG .jpg bypasses it entirely) and the inline response still sets Content-Type: image/svg+xml.

This is a stored cross-site scripting flaw (CWE-79, with the vendor also citing CWE-434 for the upload-type confusion) rated CVSS 5.4 via CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The CVSS signals are internally consistent with the documented mechanism: network-reachable (AV:N), low complexity (AC:L), requires an authenticated account with upload permission (PR:L), requires a victim to view the attachment (UI:R), and crosses a security scope (S:C) because the injected script runs in the Part-DB origin against other users' sessions. No EPSS score and no KEV status are present in the input, so there is no evidence of active exploitation; exploitation status is best described as a public PoC being published in the vendor's GHSA advisory rather than confirmed in-the-wild use. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with a medium-severity, authentication-and-interaction-gated stored XSS rather than an unauthenticated RCE. The realistic concern is privilege escalation within an instance: a low-privilege user can plant a payload that fires when an administrator views the attachment, enabling session/cookie theft and potential account takeover - meaningful for multi-user deployments but not a mass-exploitable internet-facing issue. The CVSS confidentiality/integrity impacts are both Low and availability is None, so this is a real priority to patch for multi-user Part-DB instances but not a high-urgency emergency on the available signals.

A low-privilege authenticated user uploads a file containing an SVG with an embedded <script> but names it photo.jpg; because sanitization is keyed off the user-controlled extension, the script-bearing SVG is stored unsanitized. When any other user - including an administrator - opens the attachment inline, the server returns Content-Type: image/svg+xml and the browser executes the script in the Part-DB origin, stealing the victim's session cookie. A working PoC (malicious SVG payload plus the upload curl command) is published in the vendor GHSA advisory.