CVE-2025-55194: part-db project part-db

csirt@kutim:~/threat-intel/cve/CVE-2025-55194

CVSS 5.7 · Medium EPSS 0,37%

Kerentanan Uncaught Exception pada part-db project part-db. Skor CVSS 3.1 5.7 (Medium) menurut github.com.

Deskripsi (NVD)

Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Error when attempting to view or edit that user’s profile. This makes the profile permanently inaccessible via the UI for both users and administrators, constituting a Denial of Service (DoS) within the user management interface. This issue has been patched in version 1.17.3.

Rincian

Terbit di NVD: 13 Agustus 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.7 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-248: Uncaught Exception
EPSS (30 hari): 0,37% peluang dieksploitasi; lebih tinggi dari 29,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
part-db project	part-db	Semua versi sebelum 1.17.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/Part-DB/Part-DB-server/commit/d370f976a7b0c19d502aadbaa0f93eb90c2a6ffa patch
https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww exploit · advisory pihak ketiga
https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view exploit

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.