CVE-2026-86018 in Part-DB
Summary
by MITRE • 10/23/2026
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
Part-DB is an open-source inventory management system designed for tracking electronic components, widely used by engineers and hobbyists to manage parts libraries. The software provides features for storing metadata about components as well as associated files such as datasheets or images. A critical security flaw was identified in versions prior to 2.13.2 regarding the handling of external file attachments. Specifically, when the server-side download feature is enabled, the application allows authenticated users to bypass configured maximum attachment file size limits. This vulnerability arises because the system downloads remote files and streams them directly to disk without validating or enforcing the MAX_ATTACHMENT_FILE_SIZE configuration parameter during this specific operation path.
The technical flaw stems from a lack of input validation in the server-side download mechanism. While standard local uploads are subject to strict size checks, the endpoint responsible for fetching external URLs does not apply these same constraints. An authenticated user with permissions to create or edit attachments can exploit this inconsistency by providing a URL pointing to a large file. The application will then proceed to download and store this file on the server's filesystem, ignoring the administrative limits intended to prevent excessive storage consumption. This represents a classic case of inconsistent enforcement of security controls across different code paths within the same application module.
The operational impact of this vulnerability is primarily related to resource exhaustion and availability. By repeatedly uploading large external files through this bypassed endpoint, an attacker can rapidly consume available disk space on the server hosting Part-DB. This leads to a denial of service condition where legitimate users are unable to access the inventory system because it cannot write new data or process requests due to full storage partitions. In severe cases, if the underlying operating system is not configured with safeguards against runaway processes filling disks, this could potentially lead to broader system instability affecting other services running on the same host.
This vulnerability aligns with CWE-787: Out-of-bounds Write in terms of resource consumption and more accurately maps to CWE-400: Uncontrolled Resource Consumption. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior is consistent with techniques used for Denial of Service attacks where an adversary aims to disrupt service availability by exhausting system resources rather than compromising confidentiality or integrity directly. The attack requires authentication, which limits its scope to insider threats or compromised user accounts but remains significant due to the ease of execution and high impact on infrastructure stability.
To mitigate this risk, organizations running Part-DB must upgrade immediately to version 2.13.2 or later where the patch has been applied. Until upgrading is possible, administrators should consider disabling the server-side download external file feature if it is not strictly required for their workflow. Additionally implementing robust disk usage monitoring and alerts can help detect unusual spikes in storage consumption that may indicate an ongoing exploitation attempt. Regular security audits of configuration parameters across all application endpoints are recommended to ensure consistent enforcement of resource limits throughout the entire system lifecycle.