Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
41 vulnerabilities by Penpot
CVE-2026-105696 (GCVE-0-2026-105696)
Vulnerability from nvd – Published: 2026-10-05 20:05 – Updated: 2026-10-06 16:45
VLAI
EPSS
VEX
Title
Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and the attacker's own authenticated Penpot session can retrieve the complete shape and design data of another page in the same file when its identifier is known, because get-page requires authentication. The related get-file-fragment RPC also permits share-link access without mapping fragments to authorized pages. This issue is fixed in version 2.18.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 16:44 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/52573be07… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105696",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T16:44:35.306835Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T16:45:27.145Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-x9xg-qphx-8grr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link\u0027s authorized pages set. An attacker with both a valid share link and the attacker\u0027s own authenticated Penpot session can retrieve the complete shape and design data of another page in the same file when its identifier is known, because get-page requires authentication. The related get-file-fragment RPC also permits share-link access without mapping fragments to authorized pages. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T20:05:30.908Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-x9xg-qphx-8grr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-x9xg-qphx-8grr"
},
{
"name": "https://github.com/penpot/penpot/commit/52573be07472987703b2ce715c4c10919f4e153e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/52573be07472987703b2ce715c4c10919f4e153e"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-x9xg-qphx-8grr",
"discovery": "UNKNOWN"
},
"title": "Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link\u0027s authorized scope via the get-page RPC command"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105696",
"datePublished": "2026-10-05T20:05:30.908Z",
"dateReserved": "2026-10-05T17:48:58.627Z",
"dateUpdated": "2026-10-06T16:45:27.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105695 (GCVE-0-2026-105695)
Vulnerability from nvd – Published: 2026-10-05 20:04 – Updated: 2026-10-05 20:40
VLAI
EPSS
VEX
Title
Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed upload-session UUID can assemble the victim's chunks into the attacker's own file, team font, or project import, disclosing the uploaded bytes and deleting the victim's pending session. This issue is fixed in version 2.18.0.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 20:40 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/pull/11012 | x_refsource_MISC |
| https://github.com/penpot/penpot/commit/367e4d534… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105695",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T20:40:35.188252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T20:40:42.567Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-5vrm-3c6w-gjfv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user\u0027s live, completed upload-session UUID can assemble the victim\u0027s chunks into the attacker\u0027s own file, team font, or project import, disclosing the uploaded bytes and deleting the victim\u0027s pending session. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T20:04:22.743Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-5vrm-3c6w-gjfv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-5vrm-3c6w-gjfv"
},
{
"name": "https://github.com/penpot/penpot/pull/11012",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/pull/11012"
},
{
"name": "https://github.com/penpot/penpot/commit/367e4d534c536c33d4f3fbad375f3e9c29b787a6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/367e4d534c536c33d4f3fbad375f3e9c29b787a6"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-5vrm-3c6w-gjfv",
"discovery": "UNKNOWN"
},
"title": "Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim\u0027s upload session"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105695",
"datePublished": "2026-10-05T20:04:22.743Z",
"dateReserved": "2026-10-05T17:48:58.627Z",
"dateUpdated": "2026-10-05T20:40:42.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105694 (GCVE-0-2026-105694)
Vulnerability from nvd – Published: 2026-10-05 20:02 – Updated: 2026-10-08 02:25
VLAI
EPSS
VEX
Title
Penpot: Stored XSS via Unsanitised SVG Uploads
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A victim who navigates to the asset URL executes attacker-controlled JavaScript in that origin, allowing requests and data access with the victim's Penpot session authority. This issue is fixed in version 2.18.0.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 02:24 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/security/advisor… | x_refsource_MISC |
| https://github.com/penpot/penpot/pull/10989 | x_refsource_MISC |
| https://github.com/penpot/penpot/pull/11044 | x_refsource_MISC |
| https://github.com/penpot/penpot/commit/c4dd04353… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105694",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T02:24:21.779529Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T02:25:00.547Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-xg6f-5v5x-g4w2"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A victim who navigates to the asset URL executes attacker-controlled JavaScript in that origin, allowing requests and data access with the victim\u0027s Penpot session authority. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T20:02:03.834Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-xg6f-5v5x-g4w2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-xg6f-5v5x-g4w2"
},
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-wrcr-m7p8-m2c4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-wrcr-m7p8-m2c4"
},
{
"name": "https://github.com/penpot/penpot/pull/10989",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/pull/10989"
},
{
"name": "https://github.com/penpot/penpot/pull/11044",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/pull/11044"
},
{
"name": "https://github.com/penpot/penpot/commit/c4dd04353fcf06c3e10a64e3d8e43945508ae98c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/c4dd04353fcf06c3e10a64e3d8e43945508ae98c"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-xg6f-5v5x-g4w2",
"discovery": "UNKNOWN"
},
"title": "Penpot: Stored XSS via Unsanitised SVG Uploads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105694",
"datePublished": "2026-10-05T20:02:03.834Z",
"dateReserved": "2026-10-05T17:48:58.627Z",
"dateUpdated": "2026-10-08T02:25:00.547Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105693 (GCVE-0-2026-105693)
Vulnerability from nvd – Published: 2026-10-05 19:56 – Updated: 2026-10-06 13:46
VLAI
EPSS
VEX
Title
Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, page scopes, comment permissions, and inspection permissions, then replay a more permissive token to access page data that was not included in the original share. This issue is fixed in version 2.18.0.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 13:46 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/15195b3bb… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105693",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T13:46:18.463606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:46:48.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-w8mf-4x22-24gg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links\u0027 secret IDs, page scopes, comment permissions, and inspection permissions, then replay a more permissive token to access page data that was not included in the original share. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:56:47.826Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-w8mf-4x22-24gg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-w8mf-4x22-24gg"
},
{
"name": "https://github.com/penpot/penpot/commit/15195b3bbbbf2911b24007ad42453d264a2774d4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/15195b3bbbbf2911b24007ad42453d264a2774d4"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-w8mf-4x22-24gg",
"discovery": "UNKNOWN"
},
"title": "Penpot: Anonymous share-link token disclosure \u0026 page-scope bypass via get-view-only-bundle"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105693",
"datePublished": "2026-10-05T19:56:47.826Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-06T13:46:48.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105692 (GCVE-0-2026-105692)
Vulnerability from nvd – Published: 2026-10-05 19:55 – Updated: 2026-10-06 14:50
VLAI
EPSS
VEX
Title
Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share link or has owner or administrator authority, allowing any file editor who knows a share-link UUID to delete links created by other users and revoke external reviewers' access. This issue is fixed in version 2.18.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:34 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/pull/11290 | x_refsource_MISC |
| https://github.com/penpot/penpot/commit/209aea836… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105692",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:34:14.813690Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:50:12.248Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share link or has owner or administrator authority, allowing any file editor who knows a share-link UUID to delete links created by other users and revoke external reviewers\u0027 access. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:55:36.410Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-8257-pm4f-cfhq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-8257-pm4f-cfhq"
},
{
"name": "https://github.com/penpot/penpot/pull/11290",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/pull/11290"
},
{
"name": "https://github.com/penpot/penpot/commit/209aea83658f209c4189b531eeda0f3a638a0294",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/209aea83658f209c4189b531eeda0f3a638a0294"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-8257-pm4f-cfhq",
"discovery": "UNKNOWN"
},
"title": "Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105692",
"datePublished": "2026-10-05T19:55:36.410Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-06T14:50:12.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105691 (GCVE-0-2026-105691)
Vulnerability from nvd – Published: 2026-10-05 19:53 – Updated: 2026-10-06 16:47
VLAI
EPSS
VEX
Title
Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.exec. A user who can edit a file can store shell metacharacters in the fill color and trigger SVG export, causing commands to execute with the exporter service's privileges. The same export can be triggered through a valid public share link to a malicious file. This vulnerability is fixed in 2.18.0.
Severity
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 16:46 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/pull/11272 | x_refsource_MISC |
| https://github.com/penpot/penpot/commit/aa3bc1ae9… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105691",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T16:46:58.381592Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T16:47:15.701Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-4f36-m4hj-cv86"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object\u0027s fill-color value into a ppmcolormask command string and executes that string through child_process.exec. A user who can edit a file can store shell metacharacters in the fill color and trigger SVG export, causing commands to execute with the exporter service\u0027s privileges. The same export can be triggered through a valid public share link to a malicious file. This vulnerability is fixed in 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:53:54.552Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-4f36-m4hj-cv86",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-4f36-m4hj-cv86"
},
{
"name": "https://github.com/penpot/penpot/pull/11272",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/pull/11272"
},
{
"name": "https://github.com/penpot/penpot/commit/aa3bc1ae984577f0354d4270d2546e15985f4bcf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/aa3bc1ae984577f0354d4270d2546e15985f4bcf"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-4f36-m4hj-cv86",
"discovery": "UNKNOWN"
},
"title": "Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105691",
"datePublished": "2026-10-05T19:53:54.552Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-06T16:47:15.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105690 (GCVE-0-2026-105690)
Vulnerability from nvd – Published: 2026-10-05 19:52 – Updated: 2026-10-05 20:42
VLAI
EPSS
VEX
Title
Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated requests with the victim's authority until natural expiration. This issue is fixed in version 2.18.0.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 20:41 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/7c8583729… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105690",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T20:41:59.355159Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T20:42:46.327Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser\u0027s auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated requests with the victim\u0027s authority until natural expiration. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:52:08.973Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-mj9f-5cwq-7p3q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-mj9f-5cwq-7p3q"
},
{
"name": "https://github.com/penpot/penpot/commit/7c85837290c4e7d6f7d99472b092ad4f7c9d6a97",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/7c85837290c4e7d6f7d99472b092ad4f7c9d6a97"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-mj9f-5cwq-7p3q",
"discovery": "UNKNOWN"
},
"title": "Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105690",
"datePublished": "2026-10-05T19:52:08.973Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-05T20:42:46.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105689 (GCVE-0-2026-105689)
Vulnerability from nvd – Published: 2026-10-05 19:51 – Updated: 2026-10-08 02:23
VLAI
EPSS
VEX
Title
Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT64 gateway or an attacker-controlled DNS AAAA record; cloud environments with NAT64 gateways are directly exploitable. A user controlling a media import URL, or an administrator controlling a webhook URL, can then supply an IPv6 transition address that embeds a cloud-metadata, loopback, link-local, or private IPv4 target and bypasses the intended SSRF restrictions. Media import can disclose response bodies, while webhook delivery can expose response status as a network-probing side channel. This issue is fixed in version 2.18.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 02:23 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/326d83e78… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105689",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T02:23:29.430898Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T02:23:53.207Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-wxgm-8qjw-x445"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT64 gateway or an attacker-controlled DNS AAAA record; cloud environments with NAT64 gateways are directly exploitable. A user controlling a media import URL, or an administrator controlling a webhook URL, can then supply an IPv6 transition address that embeds a cloud-metadata, loopback, link-local, or private IPv4 target and bypasses the intended SSRF restrictions. Media import can disclose response bodies, while webhook delivery can expose response status as a network-probing side channel. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:51:04.208Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-wxgm-8qjw-x445",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-wxgm-8qjw-x445"
},
{
"name": "https://github.com/penpot/penpot/commit/326d83e780ae120b45ccd6f3d7bd24922b54461c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/326d83e780ae120b45ccd6f3d7bd24922b54461c"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-wxgm-8qjw-x445",
"discovery": "UNKNOWN"
},
"title": "Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105689",
"datePublished": "2026-10-05T19:51:04.208Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-08T02:23:53.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105688 (GCVE-0-2026-105688)
Vulnerability from nvd – Published: 2026-10-05 19:50 – Updated: 2026-10-06 13:45
VLAI
EPSS
VEX
Title
Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check used by update-team-member-role. An administrator can invite another account as an owner, create multiple owners, and then use the new owner account to obtain owner-only control over the team. This issue is fixed in version 2.18.0.
Severity
6.7 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 13:44 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/5efd9cc3c… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105688",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T13:44:53.635776Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:45:35.634Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-mx4v-cmxq-644v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check used by update-team-member-role. An administrator can invite another account as an owner, create multiple owners, and then use the new owner account to obtain owner-only control over the team. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:50:01.439Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-mx4v-cmxq-644v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-mx4v-cmxq-644v"
},
{
"name": "https://github.com/penpot/penpot/commit/5efd9cc3c5689485322f57b644b83a3bd2e33cee",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/5efd9cc3c5689485322f57b644b83a3bd2e33cee"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-mx4v-cmxq-644v",
"discovery": "UNKNOWN"
},
"title": "Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105688",
"datePublished": "2026-10-05T19:50:01.439Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-06T13:45:35.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105687 (GCVE-0-2026-105687)
Vulnerability from nvd – Published: 2026-10-05 19:49 – Updated: 2026-10-06 14:50
VLAI
EPSS
VEX
Title
Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock the owner out of the team and its projects, files, fonts, and media. This issue is fixed in version 2.18.0.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:34 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/45f0153e8… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105687",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:34:15.607827Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:50:36.034Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner\u0027s team-profile-rel membership and lock the owner out of the team and its projects, files, fonts, and media. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:49:04.308Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-j83r-hph3-xpxc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-j83r-hph3-xpxc"
},
{
"name": "https://github.com/penpot/penpot/commit/45f0153e8fb1d9b70f2cb121b15780ba2c2085c4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/45f0153e8fb1d9b70f2cb121b15780ba2c2085c4"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-j83r-hph3-xpxc",
"discovery": "UNKNOWN"
},
"title": "Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member \u2014 missing owner-protection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105687",
"datePublished": "2026-10-05T19:49:04.308Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-06T14:50:36.034Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105686 (GCVE-0-2026-105686)
Vulnerability from nvd – Published: 2026-10-05 19:47 – Updated: 2026-10-06 16:49
VLAI
EPSS
VEX
Title
Penpot: Repeated chunk index causes temporary-storage amplification
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing each successful request to allocate another temporary object and increasing stored bytes beyond the upload session's declared logical size. Assembly detects the inconsistent chunk count only after allocation. This issue is fixed in version 2.18.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 16:48 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/06239844b… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105686",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T16:48:43.615963Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T16:49:35.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing each successful request to allocate another temporary object and increasing stored bytes beyond the upload session\u0027s declared logical size. Assembly detects the inconsistent chunk count only after allocation. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:47:56.283Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8"
},
{
"name": "https://github.com/penpot/penpot/commit/06239844b10b123b7757969ab7618b201d3aba3b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/06239844b10b123b7757969ab7618b201d3aba3b"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-qvq5-c536-pmx8",
"discovery": "UNKNOWN"
},
"title": "Penpot: Repeated chunk index causes temporary-storage amplification"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105686",
"datePublished": "2026-10-05T19:47:56.283Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-06T16:49:35.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105684 (GCVE-0-2026-105684)
Vulnerability from nvd – Published: 2026-10-05 19:44 – Updated: 2026-10-05 20:32
VLAI
EPSS
VEX
Title
Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threads and full comment bodies from other pages in the same file, including commenter names, email addresses, photos, and page identifiers. The disclosed page identifiers can also be used with affected page-reading functionality to access unshared design content. This issue is fixed in version 2.18.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 20:32 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/6d9f411fa… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105684",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T20:32:21.226027Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T20:32:28.848Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link\u0027s pages restriction. A holder of a page-scoped share link can retrieve comment threads and full comment bodies from other pages in the same file, including commenter names, email addresses, photos, and page identifiers. The disclosed page identifiers can also be used with affected page-reading functionality to access unshared design content. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:44:07.526Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-fwm4-hm9f-rmcp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-fwm4-hm9f-rmcp"
},
{
"name": "https://github.com/penpot/penpot/commit/6d9f411fab28a8f60cf807728f4fac2ecb646ca6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/6d9f411fab28a8f60cf807728f4fac2ecb646ca6"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-fwm4-hm9f-rmcp",
"discovery": "UNKNOWN"
},
"title": "Penpot: Share-link page-scope escape \u2014 comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105684",
"datePublished": "2026-10-05T19:44:07.526Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-05T20:32:28.848Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100868 (GCVE-0-2026-100868)
Vulnerability from nvd – Published: 2026-09-27 13:09 – Updated: 2026-10-08 15:22
VLAI
EPSS
VEX
Title
Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge
Summary
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.
Severity
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 15:39 UTC
CWE
- CWE-1327 - Binding to an Unrestricted IP Address
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | vendor-advisory |
| https://github.com/penpot/penpot/commit/b5274a447… | patch |
| https://github.com/penpot/penpot/blob/1d2c37e52c7… | technical-description |
| https://github.com/penpot/penpot/security/advisor… | relatedvendor-advisory |
| https://github.com/penpot/penpot | product |
| https://www.vulncheck.com/advisories/penpot-befor… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| penpot | penpot |
Affected:
0 , < 2.18.0
(semver)
|
|
| penpot | @penpot/mcp |
Affected:
0 , ≤ 2.15.4
(semver)
|
Date Public
2026-09-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100868",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T15:39:30.501039Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:40:09.957Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40penpot/mcp",
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"lessThan": "2.18.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://www.npmjs.com",
"defaultStatus": "unaffected",
"packageName": "@penpot/mcp",
"packageURL": "pkg:npm/%40penpot/mcp",
"product": "@penpot/mcp",
"vendor": "penpot",
"versions": [
{
"lessThanOrEqual": "2.15.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kaleidos:penpot:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.18.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1327",
"description": "Binding to an Unrestricted IP Address",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T15:22:06.862Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-ch2q-6x56-qg5r)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r"
},
{
"tags": [
"patch"
],
"url": "https://github.com/penpot/penpot/commit/b5274a44766d095247037be18c1d1918ac67ddeb"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/penpot/penpot/blob/1d2c37e52c733f74017d90b0fd1ae2d074a5c33d/mcp/packages/server/src/PluginBridge.ts#L52"
},
{
"name": "GitHub Security Advisory (GHSA-22qr-rp27-j9wm)",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm"
},
{
"tags": [
"product"
],
"url": "https://github.com/penpot/penpot"
},
{
"name": "VulnCheck Advisory: Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/penpot-before-2.18.0-unauthenticated-websocket-access-via-mcp-bridge"
}
],
"title": "Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-100868",
"datePublished": "2026-09-27T13:09:53.387Z",
"dateReserved": "2026-09-27T00:20:54.407Z",
"dateUpdated": "2026-10-08T15:22:06.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47666 (GCVE-0-2026-47666)
Vulnerability from nvd – Published: 2026-08-26 22:47 – Updated: 2026-08-27 14:08
VLAI
EPSS
VEX
Title
Penpot: Stored XSS via custom font family name injected into a @font-face style rule
Summary
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Because the backend accepts an arbitrary font-family string and the frontend writes the resulting style through innerHTML, a name containing markup such as a closing style tag followed by a script can break out of the style element and execute JavaScript on the Penpot origin. The attack is passive: any team member who opens a file referencing the malicious font triggers script execution simply by rendering the page, allowing theft of session cookies, actions performed as the victim, and access to their files and projects. This issue is fixed in version 2.15.3.
Severity
7.6 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:08 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/67d956797… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47666",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:08:34.260001Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:08:58.826Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-w5hh-gj5c-5wpc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.15.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Because the backend accepts an arbitrary font-family string and the frontend writes the resulting style through innerHTML, a name containing markup such as a closing style tag followed by a script can break out of the style element and execute JavaScript on the Penpot origin. The attack is passive: any team member who opens a file referencing the malicious font triggers script execution simply by rendering the page, allowing theft of session cookies, actions performed as the victim, and access to their files and projects. This issue is fixed in version 2.15.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T22:47:49.788Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-w5hh-gj5c-5wpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-w5hh-gj5c-5wpc"
},
{
"name": "https://github.com/penpot/penpot/commit/67d95679711da538b3b22a873bcb6c197104dc0c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/67d95679711da538b3b22a873bcb6c197104dc0c"
}
],
"source": {
"advisory": "GHSA-w5hh-gj5c-5wpc",
"discovery": "UNKNOWN"
},
"title": "Penpot: Stored XSS via custom font family name injected into a @font-face style rule"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47666",
"datePublished": "2026-08-26T22:47:49.788Z",
"dateReserved": "2026-05-19T21:10:38.797Z",
"dateUpdated": "2026-08-27T14:08:58.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47665 (GCVE-0-2026-47665)
Vulnerability from nvd – Published: 2026-08-26 22:50 – Updated: 2026-08-27 15:16
VLAI
EPSS
VEX
Title
Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML
Summary
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend applies only a length check and the frontend writes comment content directly through innerHTML, any team member who can comment on a shared file can embed HTML such as an image error handler or script that executes in the browser of every other collaborator. The attack is passive: any user who opens the comments panel on the affected file triggers script execution on the Penpot origin, allowing theft of session cookies, actions performed as the victim, and access to their files and projects. This issue is fixed in version 2.15.3.
Severity
8.7 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:16 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/29f940fb7… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47665",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:16:13.340045Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:16:47.257Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-vc72-6r45-q988"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.15.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend applies only a length check and the frontend writes comment content directly through innerHTML, any team member who can comment on a shared file can embed HTML such as an image error handler or script that executes in the browser of every other collaborator. The attack is passive: any user who opens the comments panel on the affected file triggers script execution on the Penpot origin, allowing theft of session cookies, actions performed as the victim, and access to their files and projects. This issue is fixed in version 2.15.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T22:50:34.362Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-vc72-6r45-q988",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-vc72-6r45-q988"
},
{
"name": "https://github.com/penpot/penpot/commit/29f940fb7ab521033b1e276b8285afbc3609df6c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/29f940fb7ab521033b1e276b8285afbc3609df6c"
}
],
"source": {
"advisory": "GHSA-vc72-6r45-q988",
"discovery": "UNKNOWN"
},
"title": "Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47665",
"datePublished": "2026-08-26T22:50:34.362Z",
"dateReserved": "2026-05-19T21:10:38.797Z",
"dateUpdated": "2026-08-27T15:16:47.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105696 (GCVE-0-2026-105696)
Vulnerability from cvelistv5 – Published: 2026-10-05 20:05 – Updated: 2026-10-06 16:45
VLAI
EPSS
VEX
Title
Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and the attacker's own authenticated Penpot session can retrieve the complete shape and design data of another page in the same file when its identifier is known, because get-page requires authentication. The related get-file-fragment RPC also permits share-link access without mapping fragments to authorized pages. This issue is fixed in version 2.18.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 16:44 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/52573be07… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105696",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T16:44:35.306835Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T16:45:27.145Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-x9xg-qphx-8grr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link\u0027s authorized pages set. An attacker with both a valid share link and the attacker\u0027s own authenticated Penpot session can retrieve the complete shape and design data of another page in the same file when its identifier is known, because get-page requires authentication. The related get-file-fragment RPC also permits share-link access without mapping fragments to authorized pages. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T20:05:30.908Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-x9xg-qphx-8grr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-x9xg-qphx-8grr"
},
{
"name": "https://github.com/penpot/penpot/commit/52573be07472987703b2ce715c4c10919f4e153e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/52573be07472987703b2ce715c4c10919f4e153e"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-x9xg-qphx-8grr",
"discovery": "UNKNOWN"
},
"title": "Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link\u0027s authorized scope via the get-page RPC command"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105696",
"datePublished": "2026-10-05T20:05:30.908Z",
"dateReserved": "2026-10-05T17:48:58.627Z",
"dateUpdated": "2026-10-06T16:45:27.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105695 (GCVE-0-2026-105695)
Vulnerability from cvelistv5 – Published: 2026-10-05 20:04 – Updated: 2026-10-05 20:40
VLAI
EPSS
VEX
Title
Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed upload-session UUID can assemble the victim's chunks into the attacker's own file, team font, or project import, disclosing the uploaded bytes and deleting the victim's pending session. This issue is fixed in version 2.18.0.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 20:40 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/pull/11012 | x_refsource_MISC |
| https://github.com/penpot/penpot/commit/367e4d534… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105695",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T20:40:35.188252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T20:40:42.567Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-5vrm-3c6w-gjfv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user\u0027s live, completed upload-session UUID can assemble the victim\u0027s chunks into the attacker\u0027s own file, team font, or project import, disclosing the uploaded bytes and deleting the victim\u0027s pending session. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T20:04:22.743Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-5vrm-3c6w-gjfv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-5vrm-3c6w-gjfv"
},
{
"name": "https://github.com/penpot/penpot/pull/11012",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/pull/11012"
},
{
"name": "https://github.com/penpot/penpot/commit/367e4d534c536c33d4f3fbad375f3e9c29b787a6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/367e4d534c536c33d4f3fbad375f3e9c29b787a6"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-5vrm-3c6w-gjfv",
"discovery": "UNKNOWN"
},
"title": "Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim\u0027s upload session"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105695",
"datePublished": "2026-10-05T20:04:22.743Z",
"dateReserved": "2026-10-05T17:48:58.627Z",
"dateUpdated": "2026-10-05T20:40:42.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105694 (GCVE-0-2026-105694)
Vulnerability from cvelistv5 – Published: 2026-10-05 20:02 – Updated: 2026-10-08 02:25
VLAI
EPSS
VEX
Title
Penpot: Stored XSS via Unsanitised SVG Uploads
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A victim who navigates to the asset URL executes attacker-controlled JavaScript in that origin, allowing requests and data access with the victim's Penpot session authority. This issue is fixed in version 2.18.0.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 02:24 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/security/advisor… | x_refsource_MISC |
| https://github.com/penpot/penpot/pull/10989 | x_refsource_MISC |
| https://github.com/penpot/penpot/pull/11044 | x_refsource_MISC |
| https://github.com/penpot/penpot/commit/c4dd04353… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105694",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T02:24:21.779529Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T02:25:00.547Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-xg6f-5v5x-g4w2"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A victim who navigates to the asset URL executes attacker-controlled JavaScript in that origin, allowing requests and data access with the victim\u0027s Penpot session authority. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T20:02:03.834Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-xg6f-5v5x-g4w2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-xg6f-5v5x-g4w2"
},
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-wrcr-m7p8-m2c4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-wrcr-m7p8-m2c4"
},
{
"name": "https://github.com/penpot/penpot/pull/10989",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/pull/10989"
},
{
"name": "https://github.com/penpot/penpot/pull/11044",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/pull/11044"
},
{
"name": "https://github.com/penpot/penpot/commit/c4dd04353fcf06c3e10a64e3d8e43945508ae98c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/c4dd04353fcf06c3e10a64e3d8e43945508ae98c"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-xg6f-5v5x-g4w2",
"discovery": "UNKNOWN"
},
"title": "Penpot: Stored XSS via Unsanitised SVG Uploads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105694",
"datePublished": "2026-10-05T20:02:03.834Z",
"dateReserved": "2026-10-05T17:48:58.627Z",
"dateUpdated": "2026-10-08T02:25:00.547Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105693 (GCVE-0-2026-105693)
Vulnerability from cvelistv5 – Published: 2026-10-05 19:56 – Updated: 2026-10-06 13:46
VLAI
EPSS
VEX
Title
Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, page scopes, comment permissions, and inspection permissions, then replay a more permissive token to access page data that was not included in the original share. This issue is fixed in version 2.18.0.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 13:46 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/15195b3bb… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105693",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T13:46:18.463606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:46:48.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-w8mf-4x22-24gg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links\u0027 secret IDs, page scopes, comment permissions, and inspection permissions, then replay a more permissive token to access page data that was not included in the original share. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:56:47.826Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-w8mf-4x22-24gg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-w8mf-4x22-24gg"
},
{
"name": "https://github.com/penpot/penpot/commit/15195b3bbbbf2911b24007ad42453d264a2774d4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/15195b3bbbbf2911b24007ad42453d264a2774d4"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-w8mf-4x22-24gg",
"discovery": "UNKNOWN"
},
"title": "Penpot: Anonymous share-link token disclosure \u0026 page-scope bypass via get-view-only-bundle"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105693",
"datePublished": "2026-10-05T19:56:47.826Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-06T13:46:48.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105692 (GCVE-0-2026-105692)
Vulnerability from cvelistv5 – Published: 2026-10-05 19:55 – Updated: 2026-10-06 14:50
VLAI
EPSS
VEX
Title
Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share link or has owner or administrator authority, allowing any file editor who knows a share-link UUID to delete links created by other users and revoke external reviewers' access. This issue is fixed in version 2.18.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:34 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/pull/11290 | x_refsource_MISC |
| https://github.com/penpot/penpot/commit/209aea836… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105692",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:34:14.813690Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:50:12.248Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share link or has owner or administrator authority, allowing any file editor who knows a share-link UUID to delete links created by other users and revoke external reviewers\u0027 access. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:55:36.410Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-8257-pm4f-cfhq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-8257-pm4f-cfhq"
},
{
"name": "https://github.com/penpot/penpot/pull/11290",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/pull/11290"
},
{
"name": "https://github.com/penpot/penpot/commit/209aea83658f209c4189b531eeda0f3a638a0294",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/209aea83658f209c4189b531eeda0f3a638a0294"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-8257-pm4f-cfhq",
"discovery": "UNKNOWN"
},
"title": "Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105692",
"datePublished": "2026-10-05T19:55:36.410Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-06T14:50:12.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105691 (GCVE-0-2026-105691)
Vulnerability from cvelistv5 – Published: 2026-10-05 19:53 – Updated: 2026-10-06 16:47
VLAI
EPSS
VEX
Title
Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.exec. A user who can edit a file can store shell metacharacters in the fill color and trigger SVG export, causing commands to execute with the exporter service's privileges. The same export can be triggered through a valid public share link to a malicious file. This vulnerability is fixed in 2.18.0.
Severity
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 16:46 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/pull/11272 | x_refsource_MISC |
| https://github.com/penpot/penpot/commit/aa3bc1ae9… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105691",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T16:46:58.381592Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T16:47:15.701Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-4f36-m4hj-cv86"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object\u0027s fill-color value into a ppmcolormask command string and executes that string through child_process.exec. A user who can edit a file can store shell metacharacters in the fill color and trigger SVG export, causing commands to execute with the exporter service\u0027s privileges. The same export can be triggered through a valid public share link to a malicious file. This vulnerability is fixed in 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:53:54.552Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-4f36-m4hj-cv86",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-4f36-m4hj-cv86"
},
{
"name": "https://github.com/penpot/penpot/pull/11272",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/pull/11272"
},
{
"name": "https://github.com/penpot/penpot/commit/aa3bc1ae984577f0354d4270d2546e15985f4bcf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/aa3bc1ae984577f0354d4270d2546e15985f4bcf"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-4f36-m4hj-cv86",
"discovery": "UNKNOWN"
},
"title": "Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105691",
"datePublished": "2026-10-05T19:53:54.552Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-06T16:47:15.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105690 (GCVE-0-2026-105690)
Vulnerability from cvelistv5 – Published: 2026-10-05 19:52 – Updated: 2026-10-05 20:42
VLAI
EPSS
VEX
Title
Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated requests with the victim's authority until natural expiration. This issue is fixed in version 2.18.0.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 20:41 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/7c8583729… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105690",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T20:41:59.355159Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T20:42:46.327Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser\u0027s auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated requests with the victim\u0027s authority until natural expiration. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:52:08.973Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-mj9f-5cwq-7p3q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-mj9f-5cwq-7p3q"
},
{
"name": "https://github.com/penpot/penpot/commit/7c85837290c4e7d6f7d99472b092ad4f7c9d6a97",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/7c85837290c4e7d6f7d99472b092ad4f7c9d6a97"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-mj9f-5cwq-7p3q",
"discovery": "UNKNOWN"
},
"title": "Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105690",
"datePublished": "2026-10-05T19:52:08.973Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-05T20:42:46.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105689 (GCVE-0-2026-105689)
Vulnerability from cvelistv5 – Published: 2026-10-05 19:51 – Updated: 2026-10-08 02:23
VLAI
EPSS
VEX
Title
Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT64 gateway or an attacker-controlled DNS AAAA record; cloud environments with NAT64 gateways are directly exploitable. A user controlling a media import URL, or an administrator controlling a webhook URL, can then supply an IPv6 transition address that embeds a cloud-metadata, loopback, link-local, or private IPv4 target and bypasses the intended SSRF restrictions. Media import can disclose response bodies, while webhook delivery can expose response status as a network-probing side channel. This issue is fixed in version 2.18.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 02:23 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/326d83e78… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105689",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T02:23:29.430898Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T02:23:53.207Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-wxgm-8qjw-x445"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT64 gateway or an attacker-controlled DNS AAAA record; cloud environments with NAT64 gateways are directly exploitable. A user controlling a media import URL, or an administrator controlling a webhook URL, can then supply an IPv6 transition address that embeds a cloud-metadata, loopback, link-local, or private IPv4 target and bypasses the intended SSRF restrictions. Media import can disclose response bodies, while webhook delivery can expose response status as a network-probing side channel. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:51:04.208Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-wxgm-8qjw-x445",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-wxgm-8qjw-x445"
},
{
"name": "https://github.com/penpot/penpot/commit/326d83e780ae120b45ccd6f3d7bd24922b54461c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/326d83e780ae120b45ccd6f3d7bd24922b54461c"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-wxgm-8qjw-x445",
"discovery": "UNKNOWN"
},
"title": "Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105689",
"datePublished": "2026-10-05T19:51:04.208Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-08T02:23:53.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105688 (GCVE-0-2026-105688)
Vulnerability from cvelistv5 – Published: 2026-10-05 19:50 – Updated: 2026-10-06 13:45
VLAI
EPSS
VEX
Title
Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check used by update-team-member-role. An administrator can invite another account as an owner, create multiple owners, and then use the new owner account to obtain owner-only control over the team. This issue is fixed in version 2.18.0.
Severity
6.7 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 13:44 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/5efd9cc3c… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105688",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T13:44:53.635776Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:45:35.634Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-mx4v-cmxq-644v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check used by update-team-member-role. An administrator can invite another account as an owner, create multiple owners, and then use the new owner account to obtain owner-only control over the team. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:50:01.439Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-mx4v-cmxq-644v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-mx4v-cmxq-644v"
},
{
"name": "https://github.com/penpot/penpot/commit/5efd9cc3c5689485322f57b644b83a3bd2e33cee",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/5efd9cc3c5689485322f57b644b83a3bd2e33cee"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-mx4v-cmxq-644v",
"discovery": "UNKNOWN"
},
"title": "Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105688",
"datePublished": "2026-10-05T19:50:01.439Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-06T13:45:35.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105687 (GCVE-0-2026-105687)
Vulnerability from cvelistv5 – Published: 2026-10-05 19:49 – Updated: 2026-10-06 14:50
VLAI
EPSS
VEX
Title
Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock the owner out of the team and its projects, files, fonts, and media. This issue is fixed in version 2.18.0.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:34 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/45f0153e8… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105687",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:34:15.607827Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:50:36.034Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner\u0027s team-profile-rel membership and lock the owner out of the team and its projects, files, fonts, and media. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:49:04.308Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-j83r-hph3-xpxc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-j83r-hph3-xpxc"
},
{
"name": "https://github.com/penpot/penpot/commit/45f0153e8fb1d9b70f2cb121b15780ba2c2085c4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/45f0153e8fb1d9b70f2cb121b15780ba2c2085c4"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-j83r-hph3-xpxc",
"discovery": "UNKNOWN"
},
"title": "Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member \u2014 missing owner-protection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105687",
"datePublished": "2026-10-05T19:49:04.308Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-06T14:50:36.034Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105686 (GCVE-0-2026-105686)
Vulnerability from cvelistv5 – Published: 2026-10-05 19:47 – Updated: 2026-10-06 16:49
VLAI
EPSS
VEX
Title
Penpot: Repeated chunk index causes temporary-storage amplification
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing each successful request to allocate another temporary object and increasing stored bytes beyond the upload session's declared logical size. Assembly detects the inconsistent chunk count only after allocation. This issue is fixed in version 2.18.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 16:48 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/06239844b… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105686",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T16:48:43.615963Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T16:49:35.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing each successful request to allocate another temporary object and increasing stored bytes beyond the upload session\u0027s declared logical size. Assembly detects the inconsistent chunk count only after allocation. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:47:56.283Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8"
},
{
"name": "https://github.com/penpot/penpot/commit/06239844b10b123b7757969ab7618b201d3aba3b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/06239844b10b123b7757969ab7618b201d3aba3b"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-qvq5-c536-pmx8",
"discovery": "UNKNOWN"
},
"title": "Penpot: Repeated chunk index causes temporary-storage amplification"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105686",
"datePublished": "2026-10-05T19:47:56.283Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-06T16:49:35.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105684 (GCVE-0-2026-105684)
Vulnerability from cvelistv5 – Published: 2026-10-05 19:44 – Updated: 2026-10-05 20:32
VLAI
EPSS
VEX
Title
Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope
Summary
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threads and full comment bodies from other pages in the same file, including commenter names, email addresses, photos, and page identifiers. The disclosed page identifiers can also be used with affected page-reading functionality to access unshared design content. This issue is fixed in version 2.18.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 20:32 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/6d9f411fa… | x_refsource_MISC |
| https://github.com/penpot/penpot/releases/tag/2.18.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105684",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T20:32:21.226027Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T20:32:28.848Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link\u0027s pages restriction. A holder of a page-scoped share link can retrieve comment threads and full comment bodies from other pages in the same file, including commenter names, email addresses, photos, and page identifiers. The disclosed page identifiers can also be used with affected page-reading functionality to access unshared design content. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:44:07.526Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-fwm4-hm9f-rmcp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-fwm4-hm9f-rmcp"
},
{
"name": "https://github.com/penpot/penpot/commit/6d9f411fab28a8f60cf807728f4fac2ecb646ca6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/6d9f411fab28a8f60cf807728f4fac2ecb646ca6"
},
{
"name": "https://github.com/penpot/penpot/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-fwm4-hm9f-rmcp",
"discovery": "UNKNOWN"
},
"title": "Penpot: Share-link page-scope escape \u2014 comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105684",
"datePublished": "2026-10-05T19:44:07.526Z",
"dateReserved": "2026-10-05T17:48:58.626Z",
"dateUpdated": "2026-10-05T20:32:28.848Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100868 (GCVE-0-2026-100868)
Vulnerability from cvelistv5 – Published: 2026-09-27 13:09 – Updated: 2026-10-08 15:22
VLAI
EPSS
VEX
Title
Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge
Summary
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.
Severity
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 15:39 UTC
CWE
- CWE-1327 - Binding to an Unrestricted IP Address
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | vendor-advisory |
| https://github.com/penpot/penpot/commit/b5274a447… | patch |
| https://github.com/penpot/penpot/blob/1d2c37e52c7… | technical-description |
| https://github.com/penpot/penpot/security/advisor… | relatedvendor-advisory |
| https://github.com/penpot/penpot | product |
| https://www.vulncheck.com/advisories/penpot-befor… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| penpot | penpot |
Affected:
0 , < 2.18.0
(semver)
|
|
| penpot | @penpot/mcp |
Affected:
0 , ≤ 2.15.4
(semver)
|
Date Public
2026-09-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100868",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T15:39:30.501039Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:40:09.957Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40penpot/mcp",
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"lessThan": "2.18.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://www.npmjs.com",
"defaultStatus": "unaffected",
"packageName": "@penpot/mcp",
"packageURL": "pkg:npm/%40penpot/mcp",
"product": "@penpot/mcp",
"vendor": "penpot",
"versions": [
{
"lessThanOrEqual": "2.15.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kaleidos:penpot:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.18.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1327",
"description": "Binding to an Unrestricted IP Address",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T15:22:06.862Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-ch2q-6x56-qg5r)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r"
},
{
"tags": [
"patch"
],
"url": "https://github.com/penpot/penpot/commit/b5274a44766d095247037be18c1d1918ac67ddeb"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/penpot/penpot/blob/1d2c37e52c733f74017d90b0fd1ae2d074a5c33d/mcp/packages/server/src/PluginBridge.ts#L52"
},
{
"name": "GitHub Security Advisory (GHSA-22qr-rp27-j9wm)",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm"
},
{
"tags": [
"product"
],
"url": "https://github.com/penpot/penpot"
},
{
"name": "VulnCheck Advisory: Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/penpot-before-2.18.0-unauthenticated-websocket-access-via-mcp-bridge"
}
],
"title": "Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-100868",
"datePublished": "2026-09-27T13:09:53.387Z",
"dateReserved": "2026-09-27T00:20:54.407Z",
"dateUpdated": "2026-10-08T15:22:06.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47665 (GCVE-0-2026-47665)
Vulnerability from cvelistv5 – Published: 2026-08-26 22:50 – Updated: 2026-08-27 15:16
VLAI
EPSS
VEX
Title
Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML
Summary
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend applies only a length check and the frontend writes comment content directly through innerHTML, any team member who can comment on a shared file can embed HTML such as an image error handler or script that executes in the browser of every other collaborator. The attack is passive: any user who opens the comments panel on the affected file triggers script execution on the Penpot origin, allowing theft of session cookies, actions performed as the victim, and access to their files and projects. This issue is fixed in version 2.15.3.
Severity
8.7 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:16 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/penpot/penpot/security/advisor… | x_refsource_CONFIRM |
| https://github.com/penpot/penpot/commit/29f940fb7… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47665",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:16:13.340045Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:16:47.257Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-vc72-6r45-q988"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.15.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend applies only a length check and the frontend writes comment content directly through innerHTML, any team member who can comment on a shared file can embed HTML such as an image error handler or script that executes in the browser of every other collaborator. The attack is passive: any user who opens the comments panel on the affected file triggers script execution on the Penpot origin, allowing theft of session cookies, actions performed as the victim, and access to their files and projects. This issue is fixed in version 2.15.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T22:50:34.362Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/penpot/penpot/security/advisories/GHSA-vc72-6r45-q988",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-vc72-6r45-q988"
},
{
"name": "https://github.com/penpot/penpot/commit/29f940fb7ab521033b1e276b8285afbc3609df6c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/penpot/penpot/commit/29f940fb7ab521033b1e276b8285afbc3609df6c"
}
],
"source": {
"advisory": "GHSA-vc72-6r45-q988",
"discovery": "UNKNOWN"
},
"title": "Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47665",
"datePublished": "2026-08-26T22:50:34.362Z",
"dateReserved": "2026-05-19T21:10:38.797Z",
"dateUpdated": "2026-08-27T15:16:47.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0413
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
CVE-2026-17613: Penpot cross-team file takeover via import-binfile (unpatched in 2.17.2)
Summary
Posting this as an update rather than a first disclosure. The advisory
went public on 2026-08-04 with no vendor fix. Penpot has shipped two
releases since then, 2.17.1 and 2.17.2 -- the latter 14 days ago, on
2026-08-27 -- and I re-checked the code this morning: the missing
permission check is still missing in both, and in every release before
them. It was fixed on develop the day after this advisory went public.
That fix has never shipped. Anyone running a released version of
self-hosted Penpot should know that, so here is the whole thing in one
message.
SUMMARY
=======
Penpot's file-import RPC command takes an optional caller-supplied
file-id, meaning "import into this existing file instead of creating a
new one." The handler checks that the caller may edit the project they
named -- a project they own, since they supplied it. It never checks
that the file-id they supplied belongs to them.
So any authenticated user can point that parameter at any file on the
instance and overwrite it. The same operation also re-parents the file
into the attacker's project, which is the part that matters: the
attacker does not merely destroy the victim's design, they end up owning
it. On a default install with open self-registration, the attacker needs
no prior relationship to the target at all.
AFFECTED
========
Product: Penpot (open-source design and prototyping platform, Kaleidos)
Affected: 1.20 through 2.17.2, self-hosted Community Edition and
Penpot Cloud. The in-place file-id parameter was introduced in
1.20 -- the handler's own ::doc/changes metadata records
"1.20 Add file-id param for in-place import". The CVE record
was updated 2026-08-27 to state the range as 1.20 through
2.17.1, the same day 2.17.2 shipped; 2.17.2 is also affected
and is not yet reflected in the record.
Fixed in: nothing released. Fixed on develop, unreleased, since
2026-08-05, and present in the 2.18.0 release-candidate line.
Never backported to a 2.17.x release.
CVE-2026-17613, assigned by CERT/CC as CNA, record state PUBLISHED.
CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-862
(Missing Authorization).
STILL UNPATCHED IN EVERY RELEASE -- FIXED ON DEVELOP, NOT SHIPPED
=================================================================
The published advisory last verified the flaw at develop HEAD on
2026-07-27. Penpot has released 2.17.1 and 2.17.2 since then
(2026-08-17 and 2026-08-27), and 2.17.0 shortly before it (2026-07-22).
None of the three fixes it. Verified today, 2026-09-10:
backend/src/app/rpc/commands/binfile.clj @ tag 2.17.2
line 78 (files/check-read-permissions! pool profile-id file-id)
-- export path, correct check, present
line 153 (projects/check-edition-permissions! pool profile-id project-id)
-- import path, checks only the caller's own project
line 160 (uuid? file-id)
line 161 (assoc ::bfc/file-id file-id)
-- import path, the supplied file-id bound unchecked
same file @ develop 37dab75e (2026-09-10T18:29:44Z)
line 88 (files/check-read-permissions! cfg profile-id file-id)
-- export path, correct check, present
line 166 (projects/check-edition-permissions! pool profile-id project-id)
-- import path; file-id is no longer a parameter here at
all, so there is nothing left to check
The fix exists. It just has not shipped. The day after this advisory
went public, commit 9242556d landed on develop and removed file-id from
import-binfile outright -- gone from the schema, from the handler's
destructuring, and from the audit props. Commit message: ":bug: Close
import-binfile schema and remove file-id parameter (#10994)". The same
change is in the current 2.18.0 release-candidate line (2.18.0-RC5). It
has never been backported to a 2.17.x release.
The 2.17.2 release notes list three bug fixes, one of them a different
security fix (an SVG-exporter command-injection bug, per the vendor's
own changelog) -- so the vendor does put security fixes in this line
when it chooses to. This one is not among them. The code above is
byte-identical to 2.17.0 (2026-07-22) and 2.17.1 (2026-08-17) -- the
same three call sites, the same line numbers, across the last three
releases. I am not going to guess why -- I am saying that today, 105
days after the report, nobody running a released version of Penpot has
the fix that has sat on develop, unreleased, for 36 days.
ROOT CAUSE
==========
What makes this one worth reading is that the correct check is in the
same source file, about seventy lines away, on the other direction of
the same feature.
export-binfile validates read permission on its file-id before handing
anything back:
(sv/defmethod ::export-binfile
...
[{:keys [::db/pool] :as cfg}
{:keys [::rpc/profile-id file-id] :as params}]
(files/check-read-permissions! pool profile-id file-id) ; <-- yes
(sse/response (partial export-binfile cfg params)))
import-binfile validates the caller's project and then binds the
caller's file-id straight through:
(sv/defmethod ::import-binfile
...
[{:keys [::db/pool] :as cfg}
{:keys [::rpc/profile-id project-id version file-id upload-id]
:as params}]
(projects/check-edition-permissions! pool profile-id project-id)
(let [...
cfg (cond-> cfg
(uuid? file-id)
(assoc ::bfc/file-id file-id))] ; <-- no check
...))
The permission function exists. It is already imported. It is used
correctly a few dozen lines up. The import path just does not call it.
Downstream, the in-place import fetches the target file by id alone with
no ownership predicate on the query, enables overwrite mode, writes the
attacker's content into the victim's file row, and sets that row's
project to the attacker's project. The final update is keyed only on the
attacker-supplied file id.
EXPLOITATION
============
Prerequisite: any authenticated account with a project of its own. On a
default install, self-register.
POST /api/rpc/command/import-binfile
Cookie: <attacker session>
Content-Type: multipart/form-data
project-id = <a project the attacker owns> ; checked
file-id = <the victim's file> ; NOT checked
file = <a valid single-file .penpot archive>
The obvious objection is that file ids are random UUIDs, so how do you
aim it. In practice they leak through entirely normal use, and two of
the three routes require no mistake by the victim:
1. Public share links. Clicking Share produces a URL with the file id
in it in plaintext. People send those to clients and contractors
all day. Whoever holds the link holds the targeting data.
2. Shared-library enumeration. Any user who has ever linked a shared
design-system library can read that library's file id from an
ordinary library-listing call. No error, no audit trail. This is
the route that reaches an entire organisation's design system
rather than one file.
3. Workspace and viewer URLs embed the file id, so it turns up in
screenshots, support tickets, Slack pastes and screen shares.
On attack complexity, since it came up during coordination: AC:H is
meant for conditions the attacker cannot arrange unilaterally. Receiving
a share link and listing shared libraries are ordinary actions any
account can take on its own. Complexity stays Low.
IMPACT
======
- Data destruction. The victim's file contents are replaced with the
attacker's.
- Persistent takeover. Penpot resolves file permissions by walking
file -> project -> team. Re-parenting rewrites that lineage, so the
attacker becomes the legitimate owner in the eyes of every other
endpoint, free to open, edit, export, duplicate and re-share the
victim's design. The file vanishes from the victim's project. They
cannot reach it to attempt a restore.
- Library poisoning. If the hijacked file was a shared design library,
every file in every other team that syncs from it starts pulling
attacker-controlled components, colours and typography.
- Cross-team scope. The attacker holds no authorisation on the
victim's team. The operation moves a resource out of that boundary
entirely.
Design files are not low-value data. One file can hold an unreleased
product's whole interface, pre-launch brand and marketing assets, or
mockups carrying real customer names in placeholder text. Agencies
routinely run one instance with a team per client and rely on team
separation to keep those clients confidential from each other. That
assumption does not currently hold.
The original report also bundled a lower-severity issue with the same
root pattern: the realtime WebSocket channel lets a client subscribe to
a file or team topic using a client-supplied id with no permission
check, allowing live exfiltration of collaborative edits and
shared-library changes for any file whose id you know. Same mistake --
trusting a client-supplied identifier without re-checking it. One
disciplined patch closes both.
ON THE SCORE
============
The CVE record carries 7.5 High:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
That is also the number on my own advisory. I publish the assigned score
rather than mine, because the CVE record is what the ecosystem actually
consumes and a mismatched headline number reads as inflation. It is also
the number I disagree with, and I would rather argue that in the open
than quietly ship a different one.
C:N/I:N describes the vulnerable endpoint honestly enough if you read
the operation as "the victim's file is destroyed." But the file is not
destroyed. It is moved, intact, into the attacker's project, where they
can read and export it. That is a confidentiality loss. Its contents are
then attacker-controlled, and if it was a shared library that content
propagates into other teams' files. That is an integrity loss with a
blast radius past the original resource. Scoring it A:H only measures
what the victim stopped having, not what the attacker started having.
S:U has the same problem. The operation carries a resource across a team
boundary the attacker was never authorised for; calling that scope
unchanged treats Penpot's file store as one undifferentiated pool, which
is precisely the assumption the product's team model tells customers is
false.
My pre-assignment score was 9.9. Take that as one researcher's read, not
as a correction to the record -- but if you are triaging this from the
7.5 alone, triage the impact section above instead. Worth more than
either number for that purpose: the CISA ADP Vulnrichment enrichment on
the same record carries an SSVC assessment of exploitation
proof-of-concept, technical impact partial, automatable yes. I wrote the
general version of this argument up here, alongside the same pattern in
CVE-2026-16751:
https://vokecyber.com/blog/when-cvss-scores-the-endpoint-not-the-loss
MITIGATIONS
===========
No fixed release to upgrade to, so, in order of value:
1. Disable open self-registration. Does not fix the bug. Removes the
sign-up-and-attack path and takes the score to 6.5, since the
attacker then needs an account somebody gave them.
2. Treat every account on the instance as having write access to every
file on it, and plan accordingly. If you rely on team separation
for client confidentiality, consider separate instances for
genuinely sensitive work until this is fixed.
3. Audit for prior exploitation. Look for file rows whose owning
project changed with no corresponding user action, and for edits
written by a profile that is not a member of the file's team. An
in-place import does not leave a normal change row behind, so the
signal to chase is a file whose project lineage no longer matches
the accounts that historically edited it.
4. Keep backups outs
Severity
No CVSS data available.
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Penpot | (open-source design and prototyping platform, Kaleidos) |
Affected:
unknown
|
Relationships
analysis
GCVE-1988-2026-0413 (this record)
- related CVE-2026-16751
- related CVE-2026-17613
{
"containers": {
"cna": {
"affected": [
{
"product": "(open-source design and prototyping platform, Kaleidos)",
"vendor": "Penpot",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Louis Sanchez via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "Posting this as an update rather than a first disclosure. The advisory\nwent public on 2026-08-04 with no vendor fix. Penpot has shipped two\nreleases since then, 2.17.1 and 2.17.2 -- the latter 14 days ago, on\n2026-08-27 -- and I re-checked the code this morning: the missing\npermission check is still missing in both, and in every release before\nthem. It was fixed on develop the day after this advisory went public.\nThat fix has never shipped. Anyone running a released version of\nself-hosted Penpot should know that, so here is the whole thing in one\nmessage.\n\n\nSUMMARY\n=======\n\nPenpot\u0027s file-import RPC command takes an optional caller-supplied\nfile-id, meaning \"import into this existing file instead of creating a\nnew one.\" The handler checks that the caller may edit the project they\nnamed -- a project they own, since they supplied it. It never checks\nthat the file-id they supplied belongs to them.\n\nSo any authenticated user can point that parameter at any file on the\ninstance and overwrite it. The same operation also re-parents the file\ninto the attacker\u0027s project, which is the part that matters: the\nattacker does not merely destroy the victim\u0027s design, they end up owning\nit. On a default install with open self-registration, the attacker needs\nno prior relationship to the target at all.\n\n\nAFFECTED\n========\n\nProduct: Penpot (open-source design and prototyping platform, Kaleidos)\nAffected: 1.20 through 2.17.2, self-hosted Community Edition and\n Penpot Cloud. The in-place file-id parameter was introduced in\n 1.20 -- the handler\u0027s own ::doc/changes metadata records\n \"1.20 Add file-id param for in-place import\". The CVE record\n was updated 2026-08-27 to state the range as 1.20 through\n 2.17.1, the same day 2.17.2 shipped; 2.17.2 is also affected\n and is not yet reflected in the record.\nFixed in: nothing released. Fixed on develop, unreleased, since\n 2026-08-05, and present in the 2.18.0 release-candidate line.\n Never backported to a 2.17.x release.\n\nCVE-2026-17613, assigned by CERT/CC as CNA, record state PUBLISHED.\nCWE-639 (Authorization Bypass Through User-Controlled Key), CWE-862\n(Missing Authorization).\n\n\nSTILL UNPATCHED IN EVERY RELEASE -- FIXED ON DEVELOP, NOT SHIPPED\n=================================================================\n\nThe published advisory last verified the flaw at develop HEAD on\n2026-07-27. Penpot has released 2.17.1 and 2.17.2 since then\n(2026-08-17 and 2026-08-27), and 2.17.0 shortly before it (2026-07-22).\nNone of the three fixes it. Verified today, 2026-09-10:\n\n backend/src/app/rpc/commands/binfile.clj @ tag 2.17.2\n\n line 78 (files/check-read-permissions! pool profile-id file-id)\n -- export path, correct check, present\n line 153 (projects/check-edition-permissions! pool profile-id project-id)\n -- import path, checks only the caller\u0027s own project\n line 160 (uuid? file-id)\n line 161 (assoc ::bfc/file-id file-id)\n -- import path, the supplied file-id bound unchecked\n\n same file @ develop 37dab75e (2026-09-10T18:29:44Z)\n\n line 88 (files/check-read-permissions! cfg profile-id file-id)\n -- export path, correct check, present\n line 166 (projects/check-edition-permissions! pool profile-id project-id)\n -- import path; file-id is no longer a parameter here at\n all, so there is nothing left to check\n\nThe fix exists. It just has not shipped. The day after this advisory\nwent public, commit 9242556d landed on develop and removed file-id from\nimport-binfile outright -- gone from the schema, from the handler\u0027s\ndestructuring, and from the audit props. Commit message: \":bug: Close\nimport-binfile schema and remove file-id parameter (#10994)\". The same\nchange is in the current 2.18.0 release-candidate line (2.18.0-RC5). It\nhas never been backported to a 2.17.x release.\n\nThe 2.17.2 release notes list three bug fixes, one of them a different\nsecurity fix (an SVG-exporter command-injection bug, per the vendor\u0027s\nown changelog) -- so the vendor does put security fixes in this line\nwhen it chooses to. This one is not among them. The code above is\nbyte-identical to 2.17.0 (2026-07-22) and 2.17.1 (2026-08-17) -- the\nsame three call sites, the same line numbers, across the last three\nreleases. I am not going to guess why -- I am saying that today, 105\ndays after the report, nobody running a released version of Penpot has\nthe fix that has sat on develop, unreleased, for 36 days.\n\n\nROOT CAUSE\n==========\n\nWhat makes this one worth reading is that the correct check is in the\nsame source file, about seventy lines away, on the other direction of\nthe same feature.\n\nexport-binfile validates read permission on its file-id before handing\nanything back:\n\n (sv/defmethod ::export-binfile\n ...\n [{:keys [::db/pool] :as cfg}\n {:keys [::rpc/profile-id file-id] :as params}]\n (files/check-read-permissions! pool profile-id file-id) ; \u003c-- yes\n (sse/response (partial export-binfile cfg params)))\n\nimport-binfile validates the caller\u0027s project and then binds the\ncaller\u0027s file-id straight through:\n\n (sv/defmethod ::import-binfile\n ...\n [{:keys [::db/pool] :as cfg}\n {:keys [::rpc/profile-id project-id version file-id upload-id]\n :as params}]\n (projects/check-edition-permissions! pool profile-id project-id)\n (let [...\n cfg (cond-\u003e cfg\n (uuid? file-id)\n (assoc ::bfc/file-id file-id))] ; \u003c-- no check\n ...))\n\nThe permission function exists. It is already imported. It is used\ncorrectly a few dozen lines up. The import path just does not call it.\n\nDownstream, the in-place import fetches the target file by id alone with\nno ownership predicate on the query, enables overwrite mode, writes the\nattacker\u0027s content into the victim\u0027s file row, and sets that row\u0027s\nproject to the attacker\u0027s project. The final update is keyed only on the\nattacker-supplied file id.\n\n\nEXPLOITATION\n============\n\nPrerequisite: any authenticated account with a project of its own. On a\ndefault install, self-register.\n\n POST /api/rpc/command/import-binfile\n Cookie: \u003cattacker session\u003e\n Content-Type: multipart/form-data\n\n project-id = \u003ca project the attacker owns\u003e ; checked\n file-id = \u003cthe victim\u0027s file\u003e ; NOT checked\n file = \u003ca valid single-file .penpot archive\u003e\n\nThe obvious objection is that file ids are random UUIDs, so how do you\naim it. In practice they leak through entirely normal use, and two of\nthe three routes require no mistake by the victim:\n\n 1. Public share links. Clicking Share produces a URL with the file id\n in it in plaintext. People send those to clients and contractors\n all day. Whoever holds the link holds the targeting data.\n\n 2. Shared-library enumeration. Any user who has ever linked a shared\n design-system library can read that library\u0027s file id from an\n ordinary library-listing call. No error, no audit trail. This is\n the route that reaches an entire organisation\u0027s design system\n rather than one file.\n\n 3. Workspace and viewer URLs embed the file id, so it turns up in\n screenshots, support tickets, Slack pastes and screen shares.\n\nOn attack complexity, since it came up during coordination: AC:H is\nmeant for conditions the attacker cannot arrange unilaterally. Receiving\na share link and listing shared libraries are ordinary actions any\naccount can take on its own. Complexity stays Low.\n\n\nIMPACT\n======\n\n - Data destruction. The victim\u0027s file contents are replaced with the\n attacker\u0027s.\n\n - Persistent takeover. Penpot resolves file permissions by walking\n file -\u003e project -\u003e team. Re-parenting rewrites that lineage, so the\n attacker becomes the legitimate owner in the eyes of every other\n endpoint, free to open, edit, export, duplicate and re-share the\n victim\u0027s design. The file vanishes from the victim\u0027s project. They\n cannot reach it to attempt a restore.\n\n - Library poisoning. If the hijacked file was a shared design library,\n every file in every other team that syncs from it starts pulling\n attacker-controlled components, colours and typography.\n\n - Cross-team scope. The attacker holds no authorisation on the\n victim\u0027s team. The operation moves a resource out of that boundary\n entirely.\n\nDesign files are not low-value data. One file can hold an unreleased\nproduct\u0027s whole interface, pre-launch brand and marketing assets, or\nmockups carrying real customer names in placeholder text. Agencies\nroutinely run one instance with a team per client and rely on team\nseparation to keep those clients confidential from each other. That\nassumption does not currently hold.\n\nThe original report also bundled a lower-severity issue with the same\nroot pattern: the realtime WebSocket channel lets a client subscribe to\na file or team topic using a client-supplied id with no permission\ncheck, allowing live exfiltration of collaborative edits and\nshared-library changes for any file whose id you know. Same mistake --\ntrusting a client-supplied identifier without re-checking it. One\ndisciplined patch closes both.\n\n\nON THE SCORE\n============\n\nThe CVE record carries 7.5 High:\n\n CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\nThat is also the number on my own advisory. I publish the assigned score\nrather than mine, because the CVE record is what the ecosystem actually\nconsumes and a mismatched headline number reads as inflation. It is also\nthe number I disagree with, and I would rather argue that in the open\nthan quietly ship a different one.\n\nC:N/I:N describes the vulnerable endpoint honestly enough if you read\nthe operation as \"the victim\u0027s file is destroyed.\" But the file is not\ndestroyed. It is moved, intact, into the attacker\u0027s project, where they\ncan read and export it. That is a confidentiality loss. Its contents are\nthen attacker-controlled, and if it was a shared library that content\npropagates into other teams\u0027 files. That is an integrity loss with a\nblast radius past the original resource. Scoring it A:H only measures\nwhat the victim stopped having, not what the attacker started having.\n\nS:U has the same problem. The operation carries a resource across a team\nboundary the attacker was never authorised for; calling that scope\nunchanged treats Penpot\u0027s file store as one undifferentiated pool, which\nis precisely the assumption the product\u0027s team model tells customers is\nfalse.\n\nMy pre-assignment score was 9.9. Take that as one researcher\u0027s read, not\nas a correction to the record -- but if you are triaging this from the\n7.5 alone, triage the impact section above instead. Worth more than\neither number for that purpose: the CISA ADP Vulnrichment enrichment on\nthe same record carries an SSVC assessment of exploitation\nproof-of-concept, technical impact partial, automatable yes. I wrote the\ngeneral version of this argument up here, alongside the same pattern in\nCVE-2026-16751:\n\n https://vokecyber.com/blog/when-cvss-scores-the-endpoint-not-the-loss\n\n\nMITIGATIONS\n===========\n\nNo fixed release to upgrade to, so, in order of value:\n\n 1. Disable open self-registration. Does not fix the bug. Removes the\n sign-up-and-attack path and takes the score to 6.5, since the\n attacker then needs an account somebody gave them.\n\n 2. Treat every account on the instance as having write access to every\n file on it, and plan accordingly. If you rely on team separation\n for client confidentiality, consider separate instances for\n genuinely sensitive work until this is fixed.\n\n 3. Audit for prior exploitation. Look for file rows whose owning\n project changed with no corresponding user action, and for edits\n written by a profile that is not a member of the file\u0027s team. An\n in-place import does not leave a normal change row behind, so the\n signal to chase is a file whose project lineage no longer matches\n the accounts that historically edited it.\n\n 4. Keep backups outs"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:32Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/47"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/47"
},
{
"url": "https://github.com/penpot/penpot"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://penpot.app/"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://vokecyber.com"
},
{
"url": "https://vokecyber.com/blog/cve-2026-17613-penpot-cross-team-file-takeover"
},
{
"url": "https://vokecyber.com/blog/when-cvss-scores-the-endpoint-not-the-loss"
},
{
"url": "https://vokecyber.com/research"
},
{
"url": "https://vokecyber.com/research/cve-2026-17613-penpot-cross-team-file-takeover"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-17613"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/47"
],
"discovery": "EXTERNAL"
},
"title": "CVE-2026-17613: Penpot cross-team file takeover via import-binfile (unpatched in 2.17.2)",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-16751",
"type": "related"
},
{
"destId": "CVE-2026-17613",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0413",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/47",
"automated": true,
"contentSha256": "dfb7136b474f69e1d616f18aaa2b95b5cb066a235d2de07ebdadf391f9cd9332",
"evidenceScore": 11,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/47",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-11T02:20:54Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0413"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:32Z",
"dateUpdated": "2026-10-02T04:57:32Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0413"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}