CVE-2026-105686: Penpot: Repeated chunk index causes temporary-storage amplification
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing each successful request to allocate another temporary object and increasing stored bytes beyond the upload session's declared logical size. Assembly detects the inconsistent chunk count only after allocation. This issue is fixed in version 2.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Penpotto a version that resolves this vulnerability.Fixed in 2.18.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Penpot user can exploit it through the chunked media upload RPC. The issue affects versions prior to 2.18.0.
What does an attacker need to do?
The attacker must repeatedly upload a chunk using the same valid chunk index within an upload session. Each accepted duplicate allocates an additional temporary object, even though the session's declared logical upload size does not increase.
What is the operational impact?
Repeated duplicate chunk uploads can amplify temporary-storage consumption. The inconsistency is detected only during assembly, after the temporary objects have already been allocated.
What should be done if patching cannot happen immediately?
The provided data identifies upgrading to Penpot 2.18.0 as the fix. It does not provide a documented workaround or configuration-based mitigation.