CVE-2026-59188

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin. This issue has been patched in version 2.12.3.

• CWE-79
• CWE-434

• https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.3
• https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-2vhp-c958-m47j

Published

Oct 23, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59181OpenImageIO is a toolset for reading, writing, and manipulat…6.1
• CVE-2026-59183OpenEXR is the reference implementation and specification fo…5.5
• CVE-2026-59184OpenEXR is the reference implementation and specification fo…7.1
• CVE-2026-59185identrail is a machine identity security platform for AWS, G…8.5
• CVE-2026-59186OpenEXR is the reference implementation and specification fo…7.1
• CVE-2026-59187OpenEXR is the reference implementation and specification fo…7.1
• CVE-2026-59189OpenEXR is the reference implementation and specification fo…7.1
• CVE-2026-5919Insufficient validation of untrusted input in WebSockets in …6.5
• CVE-2026-59190grav-plugin-admin is an HTML user interface that provides a …8.7
• CVE-2026-59193Grav is a file-based Web platform. Prior to 2.0.0, an authen…4.9
• CVE-2026-59194pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a cr…7.1
• CVE-2026-59195pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm…8.2