CVE-2026-17613: Penpot cross-team file takeover via import-binfile (unpatched in 2.17.2)
Penpot 2.17.2 still lacks the import-binfile permission check, leaving CVE-2026-17613 cross-team file takeover unpatched.
Penpot releases through 2.17.2 still omit a permission check on import-binfile, allowing cross-team file takeover tracked as CVE-2026-17613. The advisory was published on 2026-08-04, and the check was fixed on the develop branch the next day. That fix was not included in 2.17.1 or in 2.17.2, released on 2026-08-27. Researcher Louis Sanchez rechecked released code and confirmed the gap remains.
- CVE-2026-17613 is a missing permission check on import-binfile
- Cross-team file takeover remains in Penpot 2.17.1 and 2.17.2
- Fix landed on develop after disclosure but has not shipped
- Advisory has been public since 2026-08-04
- CVEs
- CVE-2026-17613
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-17613 | Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the… | 7.5 | <1% |
From the original article
Posted by Louis Sanchez via Fulldisclosure on Sep 22 Posting this as an update rather than a first disclosure. The advisory went public on 2026-08-04 with no vendor fix. Penpot has shipped two releases since then, 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.