File Overwrite Vulnerability in Penpot Affects Authorized Users

CVE-2026-17613

What is CVE-2026-17613?

The Penpot platform contains a serious flaw in its RPC command ::import-binfile, where the authorization check for the optional file-id parameter is insufficient. This vulnerability enables any authenticated user to overwrite files on the server indiscriminately. Furthermore, it allows these users to subscribe to WebSocket events, facilitating potential data exfiltration and manipulation. Addressing this issue is crucial to enhance the platform's security and protect sensitive information.

References