Part-DB's attachment upload handler allows authenticated users in the default users group to upload files with the original client-supplied extension. Because the blocklist does not contain phar, a .phar file is stored with its original extension in the web-served media directory and is executed as PHP when accessed, giving the attacker arbitrary code execution as the web server user.

Part-DB 2.12.1 and earlier are affected; the vulnerability exists in all versions prior to 2.12.1 of the Part-DB-server component. The default configuration writes the uploaded files to the Apache document root (public/media/) and routes .phar files to PHP-FPM, which is enabled in the included Docker images. Users with default users group membership can create attachment types that accept any extension, making the flaw exploitable without administrative rights.

The CVSS score of 9.6 classifies this flaw as critical. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires only an authenticated non-admin user in the default users group, a web server that serves .phar files as PHP, and the ability to upload a .phar attachment. Once triggered, the attacker gains remote code execution with the privileges of the www-data web process, potentially compromising the entire host.