Vulnerabilities in penpot

7 results

Vexday analysis

Penpot apresenta 4 vulnerabilidades conhecidas, com 1 crítica e acentuada atividade recente (3 publicadas nos últimos 90 dias), embora nenhuma esteja sob exploração ativa documentada. A fraqueza dominante é traversal de diretório (CWE-22), padrão em ferramentas web que requer atenção em controles de acesso a arquivos.

CVE-2026-44986CRITICALPenpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profileEPSS 0.5%CVE-2026-26202HIGHPenpot has Arbitrary File Read via create-font-variant RPC endpointEPSS 0.4%CVE-2026-17613HIGHCVE-2026-17613EPSS 0.4%CVE-2026-45805HIGHPenpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCEEPSS 0.4%CVE-2026-45806HIGHPenpot: Authenticated SSRF in remote image import via create-file-media-object-from-urlEPSS 0.4%CVE-2026-47665HIGHPenpot: Stored XSS via comment content, innerHTML renders unsanitized HTMLEPSS 0.3%CVE-2026-47666HIGHPenpot: Stored XSS via custom font family name injected into a @font-face style ruleEPSS 0.2%