Penpot CVE-2026-105695

Requires an authenticated account on the target Penpot instance (PR:L) and, critically, possession of another user's live, completed-but-not-yet-assembled upload-session UUID - exploitation is only possible against the chunked-upload flow (file import, team-font upload, or project import) during the brief window after chunks are uploaded but before assembly. The randomness of the session UUID and the narrow live window are the primary limiting factors (reflected in AC:H); there is no user-interaction requirement from the victim. Only Penpot versions prior to 2.18.0 are affected; the fix scopes the session lookup to the requesting profile.

This is a genuine but moderate-priority authorization flaw (BOLA/IDOR, CWE-862). The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L, base 5.9) is internally consistent with the description: an authenticated low-privilege user (PR:L) can act over the network (AV:N), but success is gated by high attack complexity (AC:H) because the attacker must obtain a victim's live, completed, not-yet-assembled upload-session UUID - a narrow, racy window. Confidentiality impact is high (C:H, disclosure of the victim's uploaded bytes), integrity is none (I:N), and availability is low (A:L, the victim's pending session is deleted). No EPSS score, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vulnerability, fix commit, PR, and regression test are all confirmed in Penpot's source, so the technical root cause is certain; however, the practical exploitability is constrained by the need to guess/obtain an unguessable UUID during a live upload, which keeps real-world risk lower than the C:H component alone might suggest. Overall: a real, confirmed issue worth patching, not a drop-everything emergency.

An authenticated Penpot user who is a member of the same instance observes or obtains another user's live upload-session UUID (e.g. from a completed-but-unassembled chunked upload) and calls assemble-chunks - via file import, team-font upload, or project import - passing the victim's session ID. Because assemble-chunks scoped the lookup only by session ID, the attacker receives the victim's uploaded bytes into their own object and simultaneously deletes the victim's pending session. No public exploit code is identified, and the high attack complexity reflects the difficulty of capturing a valid live session UUID.