Overview
A vulnerability in Part-DB 1.17.2 allows any authenticated user to upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Error when accessing that user’s profile. This effectively locks the affected profile in the UI for both users and administrators, constituting a Denial of Service.
Affected Versions
- Part-DB ≤ 1.17.2
Patched Versions
- Part-DB ≥ 1.17.3
Technical Details
The issue is in src/Services/Attachments/AttachmentURLGenerator.php, specifically the getThumbnailURL() method. It assumes uploaded files are valid images based solely on their extension. If a file has a valid image binary but a misleading extension (like .jpg.txt), the function throws an uncaught InvalidArgumentException:
if (!$attachment->isPicture()) {
throw new InvalidArgumentException('Thumbnail creation only works for picture attachments!');
}This method is invoked when rendering user profiles in templates/admin/user_admin.html.twig:
{% block preview_picture %}
<img src="{{ avatar_helper.avatarURL(entity) }}" style="height: 50px;">
{% endblock %}Steps to reproduce:
1. Log in as a user with permissions to change their avatar (admin or standard user).
2. Navigate to /en/user/settings.
3. Upload a valid image file but rename it with a double extension, e.g: avatar.jpg.txt
4. Submit the form to save settings.
5. Attempt to revisit the profile settings or access the user from the admin panel.
6. Result: a persistent 500 Internal Server Error occurs.Video PoC: View PoC - https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view
Impact
- Affected users cannot access their profile settings.
- Administrators cannot view, edit, or delete affected users from the admin panel.
- The broken state is persistent; manual intervention is required.
- No remote code execution, privilege escalation, or data leakage occurs, but core functionality is disrupted.
Solution
- Upgrade to Part-DB 1.17.3 or later.
- Direct patch: GitHub Commit Fix - https://github.com/Part-DB/Part-DB-server/commit/d370f976a7b0c19d502aadbaa0f93eb90c2a6ffa
Timeline
- 2025-08-06 – Vulnerability reported
- 2025-08-12 – Patch committed
- 2025-08-13 – CVE assigned (CVE-2025-55194)
- 2025-08-13 – Advisory published
References
- Patch Commit on GitHub - https://github.com/Part-DB/Part-DB-server/commit/d370f976a7b0c19d502aadbaa0f93eb90c2a6ffa
- Part-DB Security Advisory - https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww
- PoC Video - https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view