CVE-2026-105695: Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed upload-session UUID can assemble the victim's chunks into the attacker's own file, team font, or project import, disclosing the uploaded bytes and deleting the victim's pending session. This issue is fixed in version 2.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Penpotto a version that resolves this vulnerability.Fixed in 2.18.0
Event History
Frequently Asked Questions
What must an attacker have to exploit this issue?
The attacker must be authenticated and obtain the UUID of another user's live, completed upload session. The attack does not require interaction from the victim once that session ID is known.
What data and workflows are exposed?
An attacker can assemble the victim's uploaded chunks into an attacker-controlled file, team font, or project import. This discloses the uploaded bytes to the attacker.
What is the effect on the victim's upload session?
Successful exploitation deletes the victim's pending upload session, in addition to allowing the attacker to consume its uploaded content.
Which Penpot versions contain the fix?
The issue is fixed in Penpot version 2.18.0. Versions prior to 2.18.0 are affected.