CVE-2025-55194 Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload
Authenticated users can cause persistent denial of service by uploading profile pictures with misleading file extensions, blocking profile access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-55194?
CVE-2025-55194 is a medium-severity denial of service vulnerability in Part-DB-server, published on 13 Aug 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Error when attempting to view or edit that user’s profile. This makes the profile permanently inaccessible via the UI for both users and administrators, constituting a Denial of Service (DoS) within the user management interface. This issue has been patched in version 1.17.3.
Weakness: CWE-248
Which versions are affected by CVE-2025-55194?
It affects 1 product.
Products include Part-Db Project Part-Db.
How do I fix CVE-2025-55194?
No fix has been published for CVE-2025-55194 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-55194 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-55194 exists.
Other vulnerabilities in Part-DB-server
Sources
Also known as GHSA-7rv3-rcxv-69ww.