Part-DB, an open‑source inventory system for electronic components, contains a flaw that allows authenticated users to bypass the configured maximum attachment file size when using the server‑side "Download external file" feature. The server downloads the remote file and streams it directly to disk without enforcing the MAX_ATTACHMENT_FILE_SIZE limit, which can result in files larger than intended being stored. This uncontrolled resource consumption can exhaust available disk space, thereby disrupting service availability and potentially leading to a denial of service. The weakness aligns with CWE-400 for Uncontrolled Resource Consumption and CWE-770 for Resource Exhaustion.

All installations of Part-DB:Part-DB-server running versions prior to 2.13.2 are affected. The issue was addressed in release 2.13.2 and later.

With a CVSS score of 5.3, the vulnerability poses moderate severity. It requires an authenticated user who can create or edit attachments; the exploit does not require elevated privileges or special network access. An attacker can repeatedly trigger large downloads, consuming disk space until the system becomes unusable. The EPSS score is unavailable and the flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time.