CVE-2026-54630

9.6 CRITICALpublic exploit available

Published 2026-10-23 · Updated 2026-10-23

AI risk analysis

Summary: Part-DB's attachment upload handler allows authenticated users to upload PHAR files with no extension filtering, and the web server executes them as PHP due to misconfiguration, leading to remote code execution.
Exploitability: Authenticated non-admin users in the default group can exploit this by uploading a crafted .phar file and accessing it via the public media directory; exploitation requires only standard HTTP requests.
Blast radius: Successful exploitation grants the attacker full control of the web server process (www-data), enabling data theft, further lateral movement, or persistence within the infrastructure.
Detection: Look for HTTP requests to /media/ paths returning executable content (e.g., PHP execution) or unusual file creation events in the media directory with .phar extensions; check web server access logs for such requests and correlate with user authentication logs.
Prioritized remediation: Upgrade to Part-DB version 2.12.1 or later, which adds .phar to the extension blocklist and fixes the upload handler logic.

rcepharuploadwebappmisconfig

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weaknesses

CWE-434

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.