CVE-2026-59188: Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin. This issue has been patched in version 2.12.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Part-DB-serverto a version that resolves this vulnerability.Fixed in 2.12.3
Event History
Frequently Asked Questions
Who can exploit this issue and who is exposed to the resulting script execution?
An authenticated attacker who can upload attachments can exploit the issue. Any user who views the malicious attachment inline can trigger execution of the embedded JavaScript in the Part-DB origin.
What upload behavior is required to bypass sanitization?
The attacker uploads an SVG containing a JavaScript payload while giving it a non-SVG filename extension, such as .jpg. The vulnerable server bases sanitization on the user-controlled extension rather than the file's actual content type.
Which versions are affected, and what version fixes the issue?
Part-DB-server versions before 2.12.3 are affected. The issue is patched in version 2.12.3.