EUVD-2026-92779Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Penpot instance
-
DeliveryInitiate chunked media upload session
-
ExploitRepeatedly upload same valid chunk index
-
ExecutionAllocate redundant temporary storage objects
-
ImpactExhaust storage and degrade availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated Penpot account (PR:L) and access to the chunked media upload RPC, which is a standard feature rather than an optional configuration, so default pre-2.18.0 deployments are affected. The attacker must have an active upload session and resend a chunk at an already-stored valid index to force redundant temporary-object allocation. Exploitation is limited by: the authentication requirement (no anonymous abuse), the absence of pre-fix chunk-size and duplicate-index enforcement (the fix adds a 30MiB upload-max-chunk-size cap and a duplicate-index rejection), and the impact being confined to storage/availability exhaustion with no data or integrity effect. Risk is materially higher on shared multi-tenant instances than on trusted single-tenant installs. |
| Impact | This is a genuine but low-to-moderate priority issue, correctly characterized as a resource-exhaustion denial-of-service rather than a high-impact flaw. The provided CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) and score of 5.3 (Medium) are internally consistent with the description: exploitation is network-reachable and low-complexity but requires an authenticated account (PR:L), and the only impact is a low availability hit (VA:L) with no confidentiality or integrity consequence (VC:N/VI:N). No EPSS score, KEV listing, or POC is present in the provided data, so there is no signal of active or probable exploitation - the risk is bounded by the fact that an attacker must already be an authenticated user and can only degrade storage/availability, not achieve code execution or data disclosure. The signals do not conflict; the modest CVSS, the DoS tag, and the CWE-770 (uncontrolled resource allocation) classification all point the same direction. The practical risk is highest for multi-tenant/shared Penpot deployments where any registered user could abuse shared storage; for single-tenant or trusted-user installs the real-world exposure is minimal. |
| Exploit ScenarioDerived | An authenticated Penpot user opens a chunked media upload session and then repeatedly re-sends a chunk at the same valid index; because the server validates only that the index is in range and neither rejects the duplicate nor replaces the prior object, each request allocates a new temporary storage object. By looping this, the attacker inflates stored bytes far beyond the session's declared logical size, exhausting disk/storage on a shared instance. No public exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Authenticated users of Penpot prior to 2.18.0 can exhaust server-side temporary storage by repeatedly re-uploading a valid chunk index through the chunked media upload RPC, because the backend validated only that the index was in range and never rejected an index that had already been stored. Each duplicate request allocates a new temporary storage object without replacing the previous one, so the session's actual stored bytes grow unbounded relative to its declared logical size, and the mismatch is only detected at assembly time. The vulnerability requires a valid account and an active upload session, is rated 5.3 (CVSS 4.0) with availability impact only, and is addressed in Penpot 2.18.0; no public exploit code identified at time of analysis.
RemediationAI
Upgrade Penpot to 2.18.0 or later, which is the vendor-released patch for this issue (release notes: https://github.com/penpot/penpot/releases/tag/2.18.0; advisory: https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8). The fix commit 06239844b10b123b7757969ab7618b201d3aba3b introduces a 30MiB :upload-max-chunk-size cap, serialises upload-chunk with SELECT ... FOR UPDATE on the upload session plus a duplicate-index lookup against storage_object metadata, and tightens assembly to require exactly the 0..total-chunks index set; upstream fix available via commit for those cherry-picking onto older branches, though a released patched version is the supported path. Where immediate upgrade is not possible, compensating controls are: cap or quota the tempfile/temporary storage bucket used for in-progress uploads (this limits blast radius but will cause legitimate large uploads to fail once the quota is hit), reduce maximum upload size and chunk counts via reverse-proxy body-size limits and rate limiting on the authenticated RPC endpoint (may reject legitimate bulk designs), restrict who can create media upload sessions or disable the chunked upload path for low-trust projects (breaks a standard, non-optional feature), and monitor or alert on storage_object rows whose per-session byte count exceeds the declared logical size or on sessions with repeated chunk-index metadata so orphaned temporary objects can be reaped before they accumulate. Note that deleting a session's storage objects reclaims the excess; the defect is that the excess is never prevented at the time of upload.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Penpot's backend is a Clojure service (backend/src/app/rpc/commands/media.clj) backed by a PostgreSQL database and a pluggable object-storage layer. The chunked upload workflow has three phases: create-session (records :total-chunks), upload-chunk (deposits each chunk into the tempfile bucket keyed by upload-id and chunk-index metadata), and assemble-chunks. The pre-2.18.0 upload-chunk handler looked up the upload session owned by the caller and wrote the chunk with ::sto/deduplicate? false and ::sto/touch true, but performed no check for an existing object at the same (upload-id, chunk-index) pair. The root cause class is CWE-770, Allocation of Resources Without Limits or Throttling: the code enforced an index range check but had no per-chunk size cap and no duplicate-slot guard, so a caller could mint arbitrarily many distinct temporary objects under a single logical upload slot. Because assembly verified only the chunk count (not the index set), a session declaring N chunks could be filled with repeated indices and only failed after the redundant storage had already been allocated. The upstream fix hardens this in two ways: a new :upload-max-chunk-size configuration value (30MiB) is validated in config.clj and enforced per chunk, and upload-chunk now runs inside a database transaction that issues SELECT ... FOR UPDATE on the upload session, queries the storage_object table by metadata upload-id and chunk-index, and raises :validation/:duplicate-chunk-index when a slot is already occupied. assemble-chunks was additionally strengthened to compare the sorted set of stored indices against the exact 0..total-chunks range, raising :validation/:missing-chunks on gaps or duplicates rather than relying on a simple count comparison.
Know when Penpot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable RPC with low complexity but requires an authenticated account (PR:L); impact is limited storage/availability exhaustion (A:L) with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing each successful request to allocate another temporary object and increasing stored bytes beyond the upload session's declared logical size. Assembly detects the inconsistent chunk count only after allocation. This issue is fixed in version 2.18.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Penpot before version 2.13.2 contains a path traversal vulnerability in the font creation endpoint that allows authentic
Authenticated command injection in the Penpot SVG exporter prior to 2.18.0 allows a user with edit rights on a design fi
Account takeover in Penpot before 2.14.5 allows an authenticated registered user to hijack any non-blocked profile witho
Server-side request forgery in Penpot before 2.15.0 lets an authenticated file editor coerce the backend into fetching a
Missing authorization on Penpot's ::import-binfile RPC command allows any authenticated user to overwrite arbitrary file
Privilege escalation in Penpot before 2.18.0 lets a non-owner team administrator promote themselves to team owner by cre
Missing authorization checks in Penpot prior to 2.18.0 let a holder of a valid share link read design and shape data fro
Server-side request forgery in Penpot before 2.18.0 allows an authenticated user who controls a media-import URL, or an
Penpot versions prior to 2.18.0 leak the contents of other users' in-progress uploads because the backend assemble-chunk
Logout in Penpot versions prior to 2.18.0 clears the browser's auth-token cookie but leaves the matching server-side ses
Authenticated editors on a Penpot file (prior to version 2.18.0) can delete share links that were created by other users
Stored cross-site scripting in Penpot before 2.18.0 allows an authenticated user holding file-edit permission to upload
Exploit-DB