HIGH

CVE-2026-17613

2026-08-05 CVSS v3.1

CVSS

7.5

Description

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.

Weakness (CWE)

CWE-862 Missing Authorization

EPSS Score

0.42%

Probability of exploitation in next 30 days

36.2th percentile

References

https://penpot.app/ https://vokecyber.com/blog/cve-2026-17613-penpot-cross-team-file-takeover https://vokecyber.com/research/cve-2026-17613-penpot-cross-team-file-takeover

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE