Part-DB

v2.12.1 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 1mo Relational Databases

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 3 known CVEs

Topics

database electronics inventory inventory-management inventory-management-system inventory-system

+6 more

mysql part-db php symfony symfony-application symfony5

Affected surfaces

rce_ssrf auth

ReleasePort's take

Moderate signal

editorial:auto 1mo

The release patches critical security flaws: arbitrary PHP code execution via uploaded Phar files in Docker installations and an XSS vulnerability in unsanitized log entry fields. It also mandates changing the APP_SECRET to thwart REMEMBERME token forgery.

Why it matters: Severity scores of 90 (code execution) and 60 (XSS) demand immediate attention from developers, SREs, and security engineers; failing to update exposes systems to remote code execution and session hijacking.

Summary

AI summary

Updates Security fixes, Other changes, and Part-DB 2.12.1 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	Critical	Fixes arbitrary PHP code execution via uploaded Phar files in Docker installations Fixes arbitrary PHP code execution via uploaded Phar files in Docker installations Source: llm_adapter@2026-06-08 Confidence: high	—
Security	Medium	Fixes XSS vulnerability in unsanitized log entry extra field Fixes XSS vulnerability in unsanitized log entry extra field Source: llm_adapter@2026-06-08 Confidence: high	—
Security	Medium	Requires changing APP_SECRET to prevent REMEMBERME token forgery Requires changing APP_SECRET to prevent REMEMBERME token forgery Source: llm_adapter@2026-06-08 Confidence: high	—
Dependency	Medium	Updated dependencies to address known security issues in Symfony and Twig Updated dependencies to address known security issues in Symfony and Twig Source: llm_adapter@2026-06-08 Confidence: high	—

Full changelog

[!IMPORTANT]
This version contains critical security fixes, it is recommended to update to this version immediately.

Part-DB 2.12.1

Security fixes

CRITICAL: Fixed issue that users with editing rights could execute arbitary php code in the docker installations by uploading phar files
MEDIUM: Fixed XSS issue in unsanatized log entry extra. Due to the Content-Security-Policy this has limited impact, as no arbitrary javascript can be executed.
MEDIUM: The APP_SECRET env must be changed to prevent forgery of REMEMBERME tokens. To be doable an attacker requires to know the secret password hash of a user, which is not obtainable without another security issue. Administrators will see an warning banner on the homepage, asking to change the APP_SECRET.

Generate an new random 32 character string with openssl rand -hex 32 and put the value for APP_SECRET into your .env.local or the environment section of the docker-compose.yaml.

Other changes

Updated dependencies to fix known security issues in symfony and twig
Updated KiCad symbol and footprint lists

Security Fixes

CRITICAL: Prevented arbitrary PHP code execution via Phar file upload in Docker installations
MEDIUM: Fixed XSS vulnerability in unsanitized log entry extra (limited impact due to CSP)
MEDIUM: Required rotation of `APP_SECRET` env variable to prevent REMEMBERME token forgery

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Part-DB

Get notified when new releases ship.

About Part-DB

Inventory management system for your electronic components.

All releases →