CVE-2026-105695

Katalog CVE

CVSS 5.9 · Medium EPSS 0,30%

Kerentanan Missing Authorization. Skor CVSS 3.1 5.9 (Medium) menurut github.com.

Deskripsi (NVD)

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed upload-session UUID can assemble the victim's chunks into the attacker's own file, team font, or project import, disclosing the uploaded bytes and deleting the victim's pending session. This issue is fixed in version 2.18.0.

Rincian

Terbit di NVD

5 Oktober 2026

Terakhir diubah

5 Oktober 2026

Status NVD

Deferred

CVSS 3.1

5.9 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/penpot/penpot/commit/367e4d534c536c33d4f3fbad375f3e9c29b787a6
• https://github.com/penpot/penpot/pull/11012
• https://github.com/penpot/penpot/releases/tag/2.18.0
• https://github.com/penpot/penpot/security/advisories/GHSA-5vrm-3c6w-gjfv