Penpot
Monthly
Missing authorization on Penpot's ::import-binfile RPC command allows any authenticated user to overwrite arbitrary files across team boundaries and subscribe to WebSocket events for any file on the instance, enabling cross-tenant data exfiltration and data poisoning. All Penpot deployments on versions up to and including 2.17.0 are affected per EUVD intelligence, with a proof-of-concept publicly documented by vokecyber.com. The provided CVSS vector critically understates impact: it omits confidentiality and integrity loss despite the described full data exfiltration and file overwrite capability, and marks the vulnerability as unauthenticated (PR:N) contrary to the description's explicit 'authenticated user' requirement - defenders should not rely on the published vector for risk prioritization.
Account takeover in Penpot before 2.14.5 allows an authenticated registered user to hijack any non-blocked profile without knowing its password. The flaw chains three defects: create-team-invitations leaks invitation tokens, prepare-register-profile embeds an existing profile's id into the prepared-register JWE, and register-profile then mints a session on an invitation email match while skipping password verification (CWE-287). No public exploit has been identified, but the fix commit and PR diff are public and the CVSS base score is 9.9.
Server-side request forgery in Penpot before 2.15.0 lets an authenticated file editor coerce the backend into fetching attacker-chosen URLs via the remote image import feature, reaching internal-only endpoints that are normally unreachable from the outside. The :create-file-media-object-from-url RPC method passes a user-controlled URL to the shared HTTP client with no destination filtering (CVSS 7.7, scope-changed). No public exploit has been identified at time of analysis, but the fix in 2.15.0 is confirmed by the vendor advisory GHSA-35g2-w7f6-8v9h.
Penpot before version 2.13.2 contains a path traversal vulnerability in the font creation endpoint that allows authenticated users with team edit permissions to read arbitrary files from the server filesystem. By supplying local file paths such as `/etc/passwd` as font data, attackers can retrieve sensitive files including system configuration, application secrets, and credentials. Public exploit code exists for this vulnerability, which could enable further server compromise depending on the Penpot process permissions.
Missing authorization on Penpot's ::import-binfile RPC command allows any authenticated user to overwrite arbitrary files across team boundaries and subscribe to WebSocket events for any file on the instance, enabling cross-tenant data exfiltration and data poisoning. All Penpot deployments on versions up to and including 2.17.0 are affected per EUVD intelligence, with a proof-of-concept publicly documented by vokecyber.com. The provided CVSS vector critically understates impact: it omits confidentiality and integrity loss despite the described full data exfiltration and file overwrite capability, and marks the vulnerability as unauthenticated (PR:N) contrary to the description's explicit 'authenticated user' requirement - defenders should not rely on the published vector for risk prioritization.
Account takeover in Penpot before 2.14.5 allows an authenticated registered user to hijack any non-blocked profile without knowing its password. The flaw chains three defects: create-team-invitations leaks invitation tokens, prepare-register-profile embeds an existing profile's id into the prepared-register JWE, and register-profile then mints a session on an invitation email match while skipping password verification (CWE-287). No public exploit has been identified, but the fix commit and PR diff are public and the CVSS base score is 9.9.
Server-side request forgery in Penpot before 2.15.0 lets an authenticated file editor coerce the backend into fetching attacker-chosen URLs via the remote image import feature, reaching internal-only endpoints that are normally unreachable from the outside. The :create-file-media-object-from-url RPC method passes a user-controlled URL to the shared HTTP client with no destination filtering (CVSS 7.7, scope-changed). No public exploit has been identified at time of analysis, but the fix in 2.15.0 is confirmed by the vendor advisory GHSA-35g2-w7f6-8v9h.
Penpot before version 2.13.2 contains a path traversal vulnerability in the font creation endpoint that allows authenticated users with team edit permissions to read arbitrary files from the server filesystem. By supplying local file paths such as `/etc/passwd` as font data, attackers can retrieve sensitive files including system configuration, application secrets, and credentials. Public exploit code exists for this vulnerability, which could enable further server compromise depending on the Penpot process permissions.