CVE-2026-105686: Penpot Design Platform DOS Vulnerability

CVE-2026-105686 Overview

Penpot is an open-source design and prototyping platform. CVE-2026-105686 describes a resource allocation flaw [CWE-770] in the chunked media upload RPC in versions prior to 2.18.0. The server validates that a chunk index falls within range but does not reject an index already stored, nor does it replace the previous object. An authenticated user can repeatedly upload the same valid chunk index, forcing the server to allocate a new temporary object for each request. Stored bytes grow beyond the upload session's declared logical size. The assembly step only detects the inconsistent chunk count after allocation has already occurred. The issue is fixed in version 2.18.0.

Critical Impact
Authenticated users can inflate backend storage consumption well beyond declared upload size, enabling disk exhaustion and quota bypass against self-hosted Penpot instances.

Affected Products

Penpot versions prior to 2.18.0
Self-hosted Penpot deployments exposing the chunked media upload RPC
Penpot backend storage subsystem (backend/src/app/config.clj)

Discovery Timeline

2026-10-05 - CVE-2026-105686 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105686

Vulnerability Analysis

The chunked upload workflow in Penpot allows a client to submit a media file in multiple fixed-size chunks, each identified by an index. The server validates the index against the session's declared chunk count but treats repeated submissions of the same index as independent writes. Each repeated submission allocates a new temporary storage object instead of overwriting the existing one for that index.

An authenticated user can abuse this behavior to amplify stored bytes well beyond the upload session's declared logical size. The server only reconciles the chunk count during the final assembly stage, so allocation and amplification occur before any consistency check runs. This produces a classic unrestricted resource allocation condition [CWE-770] against backend object storage.

Root Cause

The root cause is missing idempotency handling in the chunk-write path. The code validates that chunk_index < total_chunks but does not check whether the index is already present in the session's chunk map. The vulnerable implementation also lacked an explicit upper bound on individual chunk size, further amplifying the impact per request.

Attack Vector

Exploitation requires an authenticated session and network access to the Penpot RPC endpoint. The attacker starts a chunked upload session, then submits the same valid chunk index repeatedly. Each request succeeds and consumes server storage. By looping across many sessions and chunks, an attacker can exhaust disk capacity on the backend host, impacting availability for all tenants of a shared instance.

text

   :quotes-upload-sessions-per-profile 5
   :quotes-upload-chunks-per-session 20
+  :upload-max-chunk-size (* 1024 1024 30) ; 30MiB

   ;; SSRF protection
   :ssrf-allowed-hosts #{}

Source: GitHub Commit 06239844. The patch introduces an explicit :upload-max-chunk-size cap of 30 MiB to bound per-chunk growth, complementing the fix that rejects duplicate chunk indices in the upload session.

Detection Methods for CVE-2026-105686

Indicators of Compromise

Repeated chunked upload RPC calls from a single authenticated session referencing the same chunk_index value.
Rapid growth of Penpot temporary object storage disproportionate to legitimate user upload volume.
Upload sessions where the sum of received chunk bytes significantly exceeds the session's declared logical file size.

Detection Strategies

Instrument the Penpot backend to log chunk index, session identifier, and byte count for every chunked upload request, then alert on duplicate indices within one session.
Correlate authenticated user identifiers with per-session storage write volume to surface outliers.
Monitor the Penpot object storage backend for abnormal temporary object creation rates tied to upload sessions that never reach the assembly stage.

Monitoring Recommendations

Track disk utilization and inode counts on Penpot storage volumes with alerting on steep short-interval growth.
Baseline normal upload sizes per user and alert when a session exceeds declared logical size by a configurable multiplier.
Review web server and reverse proxy logs for high-frequency POSTs to the chunked upload RPC endpoint from individual accounts.

How to Mitigate CVE-2026-105686

Immediate Actions Required

Upgrade all Penpot instances to version 2.18.0 or later.
Audit storage volumes for orphaned temporary chunk objects and reclaim space.
Review authentication logs and account provisioning policies to limit untrusted account creation on self-hosted instances.

Patch Information

The fix is released in Penpot 2.18.0. The patch rejects duplicate chunk indices during upload and caps individual chunk size at 30 MiB via the new :upload-max-chunk-size configuration key. See the GitHub Security Advisory GHSA-qvq5-c536-pmx8 and the Penpot 2.18.0 Release Notes for complete details.

Workarounds

Enforce strict per-profile storage quotas at the object storage layer until the upgrade is completed.
Reduce :quotes-upload-sessions-per-profile and :quotes-upload-chunks-per-session to lower exploitable allocation ceilings.
Restrict access to the Penpot RPC endpoint via network-level controls where feasible for closed deployments.

bash

# Configuration example - Penpot backend config after upgrade to 2.18.0
:quotes-upload-sessions-per-profile 5
:quotes-upload-chunks-per-session 20
:upload-max-chunk-size 31457280   # 30 MiB per chunk cap