CVE-2026-17613: Penpot cross-team file takeover via import-binfile (unpatched in 2.17.2)
Penpot 2.17.2 still lacks the import-binfile permission check, leaving CVE-2026-17613 cross-team file takeover unpatched.
Penpot releases through 2.17.2 still omit a permission check on import-binfile, allowing cross-team file takeover tracked as CVE-2026-17613. The advisory was published on 2026-08-04, and the check was fixed on the develop branch the next day. That fix was not included in 2.17.1 or in 2.17.2, released on 2026-08-27. Researcher Louis Sanchez rechecked released code and confirmed the gap remains.
- CVE-2026-17613 is a missing permission check on import-binfile
- Cross-team file takeover remains in Penpot 2.17.1 and 2.17.2
- Fix landed on develop after disclosure but has not shipped
- Advisory has been public since 2026-08-04
Vulnerabilities mentionedAll →
- CVE-2026-176137.5<1%Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the…published
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-17613 | Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the… Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning. NVD description · AI analysis pending |
Posted by Louis Sanchez via Fulldisclosure on Sep 22 Posting this as an update rather than a first disclosure. The advisory went public on 2026-08-04 with no vendor fix. Penpot has shipped two releases since then, 2.17.1 and 2.17.2 -- the latter 14 days ago, on 2026-08-27 -- and I re-checked the code this morning: the missing permission check is still missing in both, and in every release before them. It was fixed on develop the day after this advisory went public. That fix has never shipped....
This source does not provide full text. Read it at seclists.org.