Part-DB Server EUVD-2026-108573

Requires an authenticated account in Part-DB's default users group (PRESET_EDITOR), which grants parts.create, parts.edit and attachment_types.create - enough to create an attachment type with an empty file-type filter and attach a file. The attachment must be uploaded as public ('Private attachment' left unchecked), which is the default, so it lands in public/media/ under the Apache document root. Crucially, exploitation depends on the webserver routing .phar to PHP-FPM: this is true in the shipped conf-enabled/php8.4-fpm.conf of the official Docker image (FilesMatch \.ph(?:ar|p|tml)$ mapped to PHP-FPM with DocumentRoot /var/www/html/public), so the stock Docker install is vulnerable by default. Deployments on a webserver configuration that does not execute .phar would not be exploitable. The database backend is irrelevant, no admin rights are needed, and no victim interaction is required. Fixed in 2.12.1 (vulnerable <=2.12.0); updating is the vendor-stated fix.

This is a genuine high-priority issue, not an inflated CVSS score. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, 9.6) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with a scope change - all consistent with the described mechanism: an authenticated low-privilege editor uploads a .phar attachment that the stock Apache+PHP-FPM configuration executes as PHP. The vuln.today Decision label is act_now and the vendor release notes mark the fix as CRITICAL and urge immediate updating, so this should be remediated without delay. The PR:L metric is confirmed by the mechanism (a non-admin account in the default users group reaches the sink), so exploitation is authenticated, not anonymous - this is the single most important limiting factor. No CISA KEV listing and no EPSS score are present in the input, so there is no signal of widespread automated exploitation; however, the GHSA advisory supplies live-verified reproduction steps against the official jbtronics/part-db1:v2.12.0 Docker image, so the exploitation methodology is public. One inconsistency: the supplied CVSS sets A:N, yet the advisory explicitly states the resulting www-data RCE allows database and uploaded-file destruction, which implies a real availability impact - verify against vendor. Net: real, immediately actionable risk gated primarily by the need for any authenticated editor account and by webserver configuration.

An authenticated user holding only the default users-group (editor) role creates a part, creates or reuses an attachment type with an empty file-type filter, and uploads a file named like editorshell.phar containing PHP (e.g. <?php echo shell_exec("id"); ?>) as a public attachment. They then issue a plain GET for the stored file under /media/, and the shipped Apache/PHP-FPM mapping executes it, returning command output as the www-data user. The GHSA advisory includes live-verified reproduction steps demonstrating this exact chain on the official v2.12.0 Docker image.