CVE-2026-17613: Penpot cross-team file takeover via import-binfile (unpatched in 2.17.2)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-09-22 18:32 UTC
Importiert: 2026-09-27 04:21 UTC
CVSS: 7.5
Quelle-ID: full_disc
uid_hash: 6b4d95efbc031473dfe0aaaa27bf9c9bcc5c36e6b94117de364cbe3462090f62

Full Disclosure

Posted by Louis Sanchez via Fulldisclosure on Sep 22 Posting this as an update rather than a first disclosure. The advisory

went public on 2026-08-04 with no vendor fix. Penpot has shipped two

releases since then, 2.17.1 and 2.17.2 -- the latter 14 days ago, on

2026-08-27 -- and I re-checked the code this morning: the missing

permission check is still missing in both, and in every release before

them. It was fixed on develop the day after this advisory went public.

That fix has never shipped....

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-17613	HIGH	7.5	HIGH	7.5			2026-08-05

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss