CVE-2025-55194CWE-248

Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload

Medium · published August 13, 2025

CVSS v3.1
5.7
EPSS
0%
Percentile
29.7
In the wild
Unconfirmed
What it is

Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Error when attempting to view or edit that user’s profile. This makes the profile permanently inaccessible via the UI for both users and administrators, constituting a Denial of Service (DoS) within the user management interface. This issue has been patched in version 1.17.3.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00370 · 29.7th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2025-08-13T22:46Z
EPSS history
Timeline
  • 13 AUG 22:46Z
    Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload
    cvelistv5