Penpot CVE-2026-105684

Exploitation requires the attacker to possess a valid Penpot share link that is page-scoped (created with a specific :pages restriction) to a file that also contains comment threads on other, non-shared pages within that same file; the vulnerable get-comment-threads, get-comment-thread, and get-comments RPC commands then ignore the link's page restriction. Limiting factors: the attacker must already hold such a share link (so this is not fully anonymous access to arbitrary files), disclosure is bounded to pages within the same file as the link, and the issue is fully remediated in Penpot 2.18.0 - instances on 2.18.0 or later are not affected. The related commenting-permission hardening also closes a path where share-link holders with who-comment=team could bypass the comment restriction.

This is a moderate, confidentiality-only information-disclosure flaw (CWE-200) and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) correctly reflects a network-reachable RPC bug that requires a low privilege - specifically possession of a valid page-scoped share link - with no user interaction and only limited confidentiality impact. No EPSS score was provided in the input, the CVE is NOT on the CISA KEV list, and no public exploit code was supplied, so there is no evidence of active or widespread exploitation; this reads as a real but low-priority hardening issue, not an emergency. The one factor that elevates it slightly above a trivial leak is the chained impact the vendor documents: disclosed page identifiers can be fed into other page-reading functionality to reach unshared design content, so the practical confidentiality exposure is broader than 'a few comment bodies.' Because no EPSS/KEV/POC telemetry accompanies the record, prioritization should rest on exposure (is Penpot internet-facing with share links in use) rather than on an exploitation-probability signal, which is absent here.

An attacker who has been given (or has obtained) a share link scoped to a single page of a Penpot file calls the get-comment-threads or get-comments RPC command against the same file. Because the permission check validated file access but never enforced the share link's page restriction, the server returns comment threads, full comment bodies, commenter names, email addresses, photos, and page IDs from pages the link was never meant to expose. The attacker then reuses the leaked page identifiers against affected page-reading functionality to pull unshared design content. No public exploit code is provided, but the fixing commit and advisory make the logic flaw straightforward to reproduce.