Part‑DB‑server sanitizes SVG files solely based on the filename extension rather than the actual file content type. An authenticated attacker can upload a malicious SVG containing a JavaScript payload with a non‑SVG extension such as .jpg. When a user opens the attachment inline, the server sends the response with Content‑Type image/svg+xml, causing the browser to execute the embedded script in the Part‑DB origin. The result is a stored cross‑site scripting vulnerability that allows the attacker to run arbitrary code in the context of the victim’s browser, potentially compromising credentials, data, or system functionality.

The vulnerability affects the open‑source inventory management system Part‑DB‑server prior to version 2.12.3. Any deployment of Part‑DB‑server that has not applied the 2.12.3 release is potentially vulnerable.

The CVSS score is 5.4, indicating a moderate risk. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The primary attack requires an authenticated user with permission to upload attachments. Once the malicious file is uploaded, any subsequent user who views the attachment inline triggers the stored XSS. Because the exploit depends on the upload privilege, it is not possible to hijack accounts without prior authentication, but once authenticated, the attacker can abuse the stored scripts against other users.