CVE-2026-54615 Part-DB CVE debrief

Who should care

Defenders responsible for Part-DB-server deployments, particularly those with users having edit rights on owning elements, should assess exposure and implement compensating controls to prevent exploitation.

Why it matters

CVE-2026-54615 is a stored XSS vulnerability in Part-DB-server that allows a low-privileged user to inject malicious HTML/script payloads, potentially leading to elevation of privileges. Defenders should prioritize verifying exposure and implementing compensating controls for Part-DB-server versions < 2.12.1.

• Potential for malicious HTML/script payload injection
• Possible elevation of privileges through exploitation
• Required verification of Part-DB-server versions and user privileges
• Necessity for compensating controls, such as input validation and output encoding

Technical summary

The vulnerability exists in the LogEntryExtraFormatter, specifically in the CollectionElementDeleted branch, which interpolates user-controlled strings into a sprintf() template without escaping. This allows a low-privileged content editor to store an HTML/script payload as the name of a sub-element, which can then be parsed as live DOM in the browser of a higher-privileged user. The issue affects Part-DB-server versions < 2.12.1. Defenders should prioritize verifying exposure and implementing compensating controls for Part-DB-server versions < 2.12.1, particularly for users with edit rights on owning elements.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls for Part-DB-server versions < 2.12.1, particularly for users with edit rights on owning elements.

Recommended defensive actions

• Verify Part-DB-server version and upgrade to 2.12.1 or later if necessary
• Implement compensating controls, such as input validation and output encoding
• Monitor for suspicious activity, particularly in the activity-log Extra column
• Review and restrict user privileges for editing owning elements
• Conduct regular security audits and vulnerability assessments
• Track and analyze logs for potential exploitation attempts
• Implement additional security measures, such as web application firewalls

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in Part-DB-server versions < 2.12.1 and the potential for a low-privileged user to inject malicious HTML/script payloads.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.