Penpot CVE-2026-105689

Exploitation requires (1) the attacker to route the request through a NAT64 gateway or control a DNS AAAA record the Penpot server will resolve, and (2) authenticated control of a media-import URL (any user) or a webhook URL (administrator). The attacker then supplies an IPv6 transition address - NAT64 64:ff9b::/96, 6to4 2002::/16, or Teredo 2001:0000::/32 - that embeds a blocked IPv4 target (cloud metadata 169.254.169.254, loopback 127.0.0.1, link-local, or RFC1918 private ranges) to defeat the IPv4-only CIDR filtering in app.util.ssrf/blocked-address?. Limiting factors: cloud environments with an existing NAT64 gateway are directly exploitable, but non-NAT64 deployments require the harder attacker-controlled AAAA-record path; the webhook sink only yields a status-code side channel (not response bodies); and only versions prior to 2.18.0 are affected.

This is a genuine but conditional SSRF (CWE-918), best characterized as a real-but-moderate priority rather than a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N, score 6.0 MEDIUM) is internally consistent with the description: network-reachable, but with both high attack complexity (AC:H) and a present attack requirement (AT:P) reflecting the need for a NAT64 gateway or attacker-controlled DNS AAAA record, plus low privileges (PR:L) since the actor must be an authenticated user controlling a media-import URL or an administrator controlling a webhook URL. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The CVE is NOT in CISA KEV and no public exploit code was supplied in the intelligence; therefore this is 'no public exploit identified at time of analysis.' Note a meaningful environmental dependency the raw score understates in one direction and overstates in another: in cloud environments that already run NAT64 gateways the AT:P/AC:H barriers largely collapse and the flaw becomes 'directly exploitable' per the description, whereas in on-prem/non-NAT64 environments exploitation requires an attacker-controlled AAAA record and is materially harder. The confidentiality impact is asymmetric by sink: media import can disclose full response bodies (high confidentiality) while webhook delivery only leaks response status as a network-probing side channel. Net: prioritize patching for cloud-hosted Penpot instances with NAT64; lower urgency for isolated self-hosted deployments.

An authenticated Penpot user (or administrator for the webhook path) submits a media-import or webhook URL containing an IPv6 transition address such as http://[64:ff9b::a9fe:a9fe]/latest/meta-data/, which embeds the 169.254.169.254 cloud-metadata IPv4 target. Because the pre-2.18.0 blocklist only applies CIDR checks to IPv4 and never classifies NAT64/6to4/Teredo, the server resolves and fetches the internal target through a NAT64 gateway, returning cloud-metadata or internal response bodies to the attacker. No public exploit code was identified at time of analysis, though the vendor's regression tests demonstrate the exact bypass payloads.