The vulnerability allows an authenticated API user to upload files larger than the configured attachment size limit by using base64-encoded data. This bypasses the server’s size validation, potentially exhausting disk space and causing a denial of service. The weakness is reflected in CWE-400 for resource exhaustion and CWE-770 for improper bounds handling.

Part-DB: Part-DB-server, versions earlier than 2.13.2. The issue has been fixed in release 2.13.2 and later. Administrators should verify that their deployment uses a patched version.

The CVSS score of 5.3 denotes a medium severity level. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated API user with permission to create attachments, so it is not a remote exploitation that would affect unauthenticated users. The attack surface is limited to the API upload endpoint, and the impact is primarily local disk exhaustion leading to a denial of service.