Is CVE-2026-54630 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54630 being exploited in the wild.

How severe is CVE-2026-54630?

Critical severity, with a CVSS score of 9.6, published 23 October 2026.

How is CVE-2026-54630 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-54630?

Check whether you run Part-DB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54630: Part-DB arbitrary code execution via .phar attachment upload

CVE-2026-54630 · Severity: critical · CVSS 9.6 · Published 2026-10-23

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, authenticated users could upload files with a .phar extension that would be executed as PHP code when accessed through the web interface, allowing arbitrary command execution as the web server user. An attacker with basic editor privileges could read the application database, steal user credentials, modify files, or take over administrator accounts without any victim interaction.

Technologies: Part-DB. Vendors: Part-DB.

Quick answers

Is CVE-2026-54630 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54630 being exploited in the wild.
How severe is CVE-2026-54630?: Critical severity, with a CVSS score of 9.6, published 23 October 2026.
Which products and versions are affected?: Part-DB before 2.12.1.
Is there a fix for CVE-2026-54630?: Yes: fixed in 2.12.1. Until then: Restrict attachment upload permissions for non-administrative users or ensure the web server configuration does not execute .phar files as PHP. Additionally, place uploaded media outside the web root or configure the web server to serve attachments with appropriate MIME types that prevent code execution. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54630 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-54630?: Check whether you run Part-DB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.12.1

Restrict attachment upload permissions for non-administrative users or ensure the web server configuration does not execute .phar files as PHP. Additionally, place uploaded media outside the web root or configure the web server to serve attachments with appropriate MIME types that prevent code execution.

Technical details

The upload handler in AttachmentSubmitHandler::upload() fails to block .phar files, despite maintaining a blacklist for other dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess). The stored file is placed in the publicly accessible /media/ directory with its original extension intact. The Apache configuration in the default Docker image is configured to route .phar files to PHP-FPM for execution. Any authenticated user in the default users group can exploit this by creating an attachment type with an empty filter and uploading a .phar file containing PHP code, which executes when fetched via HTTP.

Affected products

Part-DB Part-DB before 2.12.1

Timeline

2026-06-16: disclosed
2026-06-16: patched: Version 2.12.1 released with critical security fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.