Penpot EUVD-2026-92713

Requires an authenticated account with file-edit permission on a Penpot file/team, so an attacker must already be a trusted collaborator or have compromised such an account - this limits exploitation to multi-user or externally-shared Penpot instances. The attacker must upload an SVG whose <script>, event-handler attributes, or <foreignObject> elements survive unsanitized storage and are served as image/svg+xml from the Penpot origin. Exploitation additionally depends on a victim navigating directly to the stored asset URL (UI:R), not merely viewing it in a sanitizing context. These conditions - required authenticated privilege and required victim navigation - meaningfully reduce real-world risk below what a raw network-vector CVSS might suggest; single-user or tightly-trusted deployments face little exposure.

This is a moderate-severity stored XSS (CWE-79) with a realistic but constrained risk profile. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) tells a coherent story: network-reachable, low attack complexity, but it requires an authenticated attacker holding file-edit permission (PR:L) AND a victim who navigates to the malicious asset URL (UI:R). The scope change (S:C) is well-justified - attacker-controlled JavaScript executes in the Penpot origin under the victim's session authority, crossing the trust boundary from the uploaded object to the authenticated application context. Impact is capped at Low/Low for confidentiality and integrity (session-scoped requests and data access, not full account takeover or availability loss). No EPSS score, KEV listing, SSVC decision, or public exploit code was provided; the GitHub references are vendor security advisories, patch PRs, and the fix commit/release, not weaponized exploits. There is therefore no evidence of active exploitation or automatability - the signals are internally consistent (not conflicting), and this is best treated as a priority patch for Penpot operators who host untrusted or multi-user teams, rather than a mass-exploitation emergency. EPSS is absent, so exploitation probability cannot be quantified from the input.

An authenticated user with file-edit rights on a shared Penpot team uploads an SVG containing a malicious <script> or event-handler payload, which the backend stores unsanitized and serves as image/svg+xml from the Penpot origin. When a co-worker opens or navigates directly to that asset URL, the attacker's JavaScript runs in the victim's authenticated Penpot session and issues API requests or reads data with the victim's authority. No public exploit code was identified, though the fix (serving non-public buckets with Content-Disposition: attachment) is documented in the patch PRs.