CVE-2026-105686: fallo de gravedad media en penpot
Penpot: Repeated chunk index causes temporary-storage amplification
Publicada el · Actualizada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.3%
probabilidad de explotación
0.3%top 84% de las CVE
explotación observada
noninguna fuente lo reporta
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing each successful request to allocate another temporary object and increasing stored bytes beyond the upload session's declared logical size. Assembly detects the inconsistent chunk count only after allocation. This issue is fixed in version 2.18.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Productos afectados
penpot · penpotCVEs relacionadas — penpot
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-26202HIGHPenpot has Arbitrary File Read via create-font-variant RPC endpointEPSS 0.6%CVE-2026-44986CRITICALPenpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profileEPSS 0.5%CVE-2026-47665HIGHPenpot: Stored XSS via comment content, innerHTML renders unsanitized HTMLEPSS 0.4%CVE-2026-45805HIGHPenpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCEEPSS 0.4%CVE-2026-105691CRITICALPenpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-colorEPSS 0.4%CVE-2026-45806HIGHPenpot: Authenticated SSRF in remote image import via create-file-media-object-from-urlEPSS 0.4%