Key points
- CVE-2026-54630 is rated Critical with a CVSS score of 9.6.
- The flaw affects Part-DB versions prior to 2.12.1.
- A patch is available in version 2.12.1.
Part-DB inventory management systems running versions older than 2.12.1 are affected by a critical security flaw. A fix is available in version 2.12.1. Administrators must upgrade immediately to prevent remote code execution.
In plain English
The vulnerability, tracked as CVE-2026-54630, allows any logged-in user to run malicious code on the server. The system fails to block files with the phar extension during uploads. When a user uploads such a file, the server treats it as executable PHP code.
The background
The National Vulnerability Database rates this issue as Critical with a CVSS score of 9.6. The flaw stems from an incomplete blocklist in the upload handler. While dangerous extensions like php and sh are blocked, phar is missing.
What changes now
Version 2.12.1 patches this issue by correcting the extension filter. Users on older versions remain exposed to arbitrary code execution. The default configuration includes the vulnerability, making all standard installations at risk until updated.
Who needs to act first
Teams usually prioritize systems exposed to the internet or internal networks with high user access. Check whether your deployment uses default configurations that allow broad upload permissions. Back up your database and configuration files before applying updates. Test the update in a staging environment if possible to ensure compatibility. Roll out the fix to production systems immediately after validation. Monitor logs for any signs of unauthorized file uploads during the transition period.
What to do and how to stay safe: Part-DB
- Update your Part-DB installation to version 2.12.1 or later as soon as possible.
- Review server logs for any unexpected file uploads or execution attempts since the last update.
- Restrict upload permissions to trusted administrative accounts until the patch is fully deployed.
- Verify that your web server configuration does not serve executable files from upload directories.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is this vulnerability being actively exploited?
The source material does not state whether the flaw is currently being exploited in the wild.
Which versions of Part-DB are affected?
All versions of Part-DB prior to version 2.12.1 are affected by this vulnerability.
What is the severity of this flaw?
The National Vulnerability Database rates CVE-2026-54630 as Critical with a CVSS score of 9.6.
