Executive Summary
CVE-2026-54630 affects Part-DB, an open source inventory management system for electronic components. Before version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension. Its extension blocklist does not include phar, so a phar file can be placed in a directory the web server serves.
CVSS Score: 9.6 (Critical)
The NVD entry was published on October 23, 2026. We could not retrieve the full NVD record, so details below come from the published description.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-54630 |
| CVSS Score | 9.6 (Critical) |
| Type | Unrestricted file upload via incomplete blocklist |
| Component | Part attachment upload handler |
| Fixed Version | 2.12.1 |
Blocklists of dangerous extensions are fragile: any executable type left off the list becomes a bypass. Because the file keeps the client-supplied extension and lives in a web-served path, an uploaded phar archive can be reached directly over HTTP. Whether it executes depends on how the PHP and web server configuration handles .phar files.
Remediation
- Upgrade Part-DB to 2.12.1 or later.
- Review the media and attachment directories for files with
pharor other unexpected extensions, and remove any you cannot account for. - Restrict who can upload attachments until the upgrade is done.
- Configure the web server to deny script execution in upload directories.