CVE-2026-86019 in Part-DB
Summary
by MITRE • 10/23/2026
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces the configured attachment size limit for normal browser-based file uploads, but the API base64 upload path does not apply the same size validation. As a result, an authenticated user with API access and permission to create attachments can upload files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
Part-DB is an open-source inventory management system designed for tracking electronic components, widely used by engineers and hobbyists to manage parts libraries. The software provides both web-based interfaces and application programming interface endpoints to facilitate integration with other tools and automated workflows. A significant security flaw was identified in versions prior to 2.13.2 regarding the handling of file attachments through its API. While the system implements robust validation for standard browser-based uploads, it fails to apply equivalent constraints when processing files uploaded via base64-encoded data through the API endpoints. This discrepancy creates a path for authenticated users with permission to create attachments to bypass configured maximum attachment size limits.
The technical root cause of this vulnerability lies in an inconsistency within the application's input validation logic. When a user uploads a file through the standard web interface, the server checks the file size against the administrator-defined limit and rejects oversized files. However, when data is submitted via the API using base64 encoding, the system decodes the payload but neglects to verify that the resulting decoded binary content adheres to the same size restrictions. This oversight allows an attacker who possesses valid authentication credentials and appropriate permissions to submit arbitrarily large payloads. Because the validation step is missing specifically for this code path, the server accepts and processes these oversized files without triggering any error or rejection mechanism.
The operational impact of this vulnerability centers on resource exhaustion and potential denial of service conditions. By repeatedly uploading excessively large attachments through the API endpoint, an authenticated attacker can consume significant amounts of disk space allocated to the Part-DB instance. This uncontrolled growth in storage usage can lead to full disk capacity, which may cause the application to crash or become unresponsive for all users. In severe cases, this could disrupt critical inventory management operations and require manual intervention by system administrators to clear excess data and restore service availability. The vulnerability is classified under CWE-400, Uncontrolled Resource Consumption, as it allows a user to exhaust server resources through improper input validation.
Mitigation strategies primarily involve upgrading the Part-DB software to version 2.13.2 or later, where this specific logic flaw has been corrected and size validation is consistently applied across all upload methods. For organizations unable to upgrade immediately due to operational constraints, implementing network-level controls such as rate limiting on API endpoints can help mitigate the risk of rapid disk exhaustion. Additionally, configuring web server proxies like Nginx or Apache to enforce strict request body size limits provides an effective defense-in-depth measure that operates independently of the application logic. Monitoring disk usage trends and setting up alerts for unusual spikes in storage consumption can also aid in early detection of such abuse attempts. This vulnerability aligns with ATT&CK technique T1496, Resource Hijacking, where attackers leverage system resources to degrade service availability rather than directly compromising data confidentiality or integrity.