Read the docs
TI-2026-79543 Aliases CVE-2026-86018

Part-DB attachment downloads let users exhaust disk space

Priority MEDIUM 57CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Part-DB-server before 2.13.2 does not enforce the configured maximum attachment size when it downloads external files for attachments. An authenticated user who can create or edit attachments can store files larger than that limit, which can exhaust disk space and cause a denial of service (CWE-770). The flaw affects only installations where server-side attachment downloads are enabled.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00405 35th percentileScored 2026-11-07
Fix Fixed Part-DB-server (Part-DB): 2.13.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Part-DBPart-DB-serverbefore 2.13.22.13.2Patch availableCNA
  • Part-DB-server VendorPart-DB Affected before 2.13.2 Fixed in 2.13.2 Patch available CNA

Remediation

Upgrade Part-DB-server to version 2.13.2, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Part-DB-server (Part-DB) Fixed in 2.13.2

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-86018
  2. 2026-10-29 CISA SSVC decision points changed
  3. 2026-10-29 Priority changed: LOW → MEDIUM

References

Other 2

  • TI-2026-79546 Password reset link poisoning in Part-DB allows account takeover CVSS 4.0HIGH 8.7
  • TI-2019-15485 Part-DB 0.4 Authentication Bypass via login.php CVSS 4.0HIGH 8.8
  • TI-2026-79538 Part-DB attachment upload allows PHP execution via .phar files CVSS 3.1CRITICAL 9.6
  • TI-2022-00754 OS Command Injection in part-db/part-db CVSS 3.1CRITICAL 9.8
  • TI-2026-79539 Hardcoded APP_SECRET in Part-DB enables forged login cookies CVSS 3.1MEDIUM 6.3
  • TI-2026-79540 Stored HTML injection in Part-DB BOM validation results CVSS 4.0MEDIUM 5.7
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences