CVE-2026-54630 | CVSS: 9.6 | 严重级别: CRITICAL
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, …) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache docume
参考链接:
• https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1
• https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-w5m7-3xf7-6g7
📌 数据来源: NVD 官方