CVE-2025-55194

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-55194
Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Error when attempting to view or edit that user’s profile. This makes the profile permanently inaccessible via the UI for both users and administrators, constituting a Denial of Service (DoS) within the user management interface. This issue has been patched in version 1.17.3.

5.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view Exploit
https://github.com/Part-DB/Part-DB-server/commit/d370f976a7b0c19d502aadbaa0f93eb90c2a6ffa Patch
https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww Exploit Third Party Advisory
https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view Exploit
https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:part-db_project:part-db:*:*:*:*:*:*:*:*
History

26 Aug 2025, 19:17

Type Values Removed Values Added
CPE cpe:2.3:a:part-db_project:part-db:*:*:*:*:*:*:*:*
References () https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view - () https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view - Exploit
References () https://github.com/Part-DB/Part-DB-server/commit/d370f976a7b0c19d502aadbaa0f93eb90c2a6ffa - () https://github.com/Part-DB/Part-DB-server/commit/d370f976a7b0c19d502aadbaa0f93eb90c2a6ffa - Patch
References () https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww - () https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww - Exploit, Third Party Advisory
First Time Part-db Project part-db
Part-db Project

14 Aug 2025, 15:15

Type Values Removed Values Added
References () https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view - () https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view -
References () https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww - () https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww -

14 Aug 2025, 13:11

Type Values Removed Values Added
Summary
  • (es) Part-DB es un sistema de gestión de inventario de código abierto para componentes electrónicos. Antes de la versión 1.17.3, cualquier usuario autenticado podía subir una foto de perfil con una extensión de archivo engañosa (p. ej., .jpg.txt), lo que provocaba un error interno del servidor 500 persistente al intentar ver o editar el perfil de dicho usuario. Esto hacía que el perfil fuera permanentemente inaccesible a través de la interfaz de usuario, tanto para usuarios como para administradores, lo que constituía una denegación de servicio (DoS) en la interfaz de administración de usuarios. Este problema se ha corregido en la versión 1.17.3.

13 Aug 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-13 23:15

Updated : 2025-08-26 19:17

NVD link : CVE-2025-55194

Mitre link : CVE-2025-55194

CVE.ORG link : CVE-2025-55194

JSON object : View

Products Affected

part-db_project

  • part-db
CWE
CWE-248

Uncaught Exception