Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.

Affected: Penpot (open-source design and prototyping platform, Kaleidos)

Posting this as an update rather than a first disclosure. The advisory went public on 2026-08-04 with no vendor fix. Penpot has shipped two releases since then, 2.17.1 and 2.17.2 -- the latter 14 days ago, on 2026-08-27 -- and I re-checked the code this morning: the missing permission check is still missing in both, and in every release before them. It was fixed on develop the day after this advisory went public. That fix has never shipped. Anyone running a released version of self-hosted Penpot should know that, so here is the whole thing in one message.

SUMMARY =======

Penpot's file-import RPC command takes an optional caller-supplied file-id, meaning "import into this existing file instead of creating a new one." The handler checks that the caller may edit the project they named -- a project they own, since they supplied it. It never checks that the file-id they supplied belongs to them.

So any authenticated user can point that parameter at any file on the instance and overwrite it. The same operation also re-parents the file into the attacker's project, which is the part that matters: the attacker does not merely destroy the victim's design, they end up owning it. On a default install with open self-registration, the attacker needs no prior relationship to the target at all.

AFFECTED ========

Product: Penpot (open-source design and prototyping platform, Kaleidos) Affected: 1.20 through 2.17.2, self-hosted Community Edition and Penpot Cloud. The in-place…

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.