Part‑DB includes a spreadsheet formula injection flaw in its part import/export workflow. An attacker with import privileges can place formula‑prefixed values such as =1+1 in a CSV file. When the tolerant CSV is later exported to XLSX, the application writes the raw value into the spreadsheet cell using PhpSpreadsheet’s setCellValue() without sanitizing formula characters. The resulting XLSX contains an executable formula cell, and if another user opens the file the spreadsheet software will evaluate the formula. This can reveal sensitive data, cause incorrect calculations, or serve as a vector for drive‑by code execution within the spreadsheet environment.

The vulnerability is present in Part‑DB:Part‑DB‑server for all releases prior to version 2.13.2. Users of earlier releases should upgrade to 2.13.2 or later to receive the fix.

The CVSS score of 4.6 indicates a moderate severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog. The attack requires an authenticated user with permission to import parts and a second user who later opens the exported XLSX. The risk is moderate because the attacker cannot directly gain control of the server but can influence the content evaluated by a victim’s spreadsheet application.