Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-105695

CVE-2026-105695: Penpot Upload Session Auth Bypass Flaw

CVE-2026-105695 is an authentication bypass vulnerability in Penpot that allows attackers to access and assemble other users upload sessions, leading to data disclosure. This post covers technical details, affected versions, impact, and mitigation steps.

Published:

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Sources: National Vulnerability Database, CISA KEV, Exploit-DB

CVE-2026-105695 Overview

Penpot, an open-source design and prototyping platform, contains a missing authorization flaw [CWE-862] in its chunked upload workflow. Prior to version 2.18.0, the assemble-chunks function retrieves an upload session using only its session ID, without verifying ownership against the authenticated profile. The companion upload-chunk function correctly scopes lookups to the authenticated profile, creating an inconsistent trust boundary. An authenticated attacker who obtains another user's live, completed upload-session UUID can assemble the victim's chunks into their own file, team font, or project import. This action discloses the uploaded bytes to the attacker and deletes the victim's pending session.

Critical Impact

Authenticated users can hijack active upload sessions belonging to other Penpot users, exfiltrating uploaded file contents and destroying the victim's pending upload state.

Affected Products

  • Penpot versions prior to 2.18.0
  • Penpot self-hosted deployments using the chunked upload API
  • Penpot SaaS tenants exposing binfile and fonts RPC commands

Discovery Timeline

  • 2026-10-05 - CVE CVE-2026-105695 published to NVD
  • 2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-105695

Vulnerability Analysis

The vulnerability resides in Penpot's backend RPC commands that handle chunked uploads for binary files and team fonts. Two related functions govern the upload lifecycle: upload-chunk accepts individual chunks and correctly scopes database lookups by profile-id, while assemble-chunks finalizes the upload by combining stored chunks into a complete artifact. The assemble-chunks path, however, resolved the upload session using only the upload-id session UUID. No authorization check tied the session to the caller's authenticated identity. The weakness is classified under CWE-862: Missing Authorization.

Root Cause

The root cause is inconsistent authorization enforcement across functions that operate on the same resource. upload-chunk applied a profile-scoped lookup, but assemble-chunks did not propagate the profile-id from the RPC context into the database query. This design flaw let any authenticated user act on any session UUID they could obtain, regardless of session ownership.

Attack Vector

Exploitation requires an authenticated Penpot account and knowledge of a target's active, completed upload-session UUID. The attacker calls assemble-chunks with the victim's upload-id, directing the assembled output into the attacker's own file, team font, or project import. The backend returns the assembled bytes to the attacker and removes the victim's pending session as a side effect, producing confidentiality loss and limited availability impact for the victim.

text
         params
         (if (some? upload-id)
-          (let [file (db/tx-run! cfg media-cmd/assemble-chunks upload-id)]
+          (let [file (db/tx-run! cfg media-cmd/assemble-chunks profile-id upload-id)]
             (assoc params :file file))
           params)

Source: GitHub Commit 367e4d5 — patch to backend/src/app/rpc/commands/binfile.clj adding profile-id scoping to the assembly call.

text
  "Assembles each chunked-upload session in `uploads` (a `{mtype →
   session-id}` map) into a temp file, validates the media type and
   size of every entry, and returns a `{mtype → path}` data map."
-  [cfg {:keys [uploads] :as params}]
+  [cfg {:keys [::rpc/profile-id uploads] :as params}]
   (let [data (reduce-kv
               (fn [acc mtype session-id]
-                (let [assembled (assemble-chunks cfg session-id)]
+                (let [assembled (assemble-chunks cfg profile-id session-id)]
                   (-> {:mtype mtype :size (:size assembled)}
                       (media.v/validate-media-type! cm/font-types)
                       (media.v/validate-font-size!))

Source: GitHub Commit 367e4d5 — corresponding fix in backend/src/app/rpc/commands/fonts.clj for team font assembly.

Detect Identity Attacks the Moment Authentication Fails

Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.

Stop Identity Attacks

Detection Methods for CVE-2026-105695

Indicators of Compromise

  • RPC calls to assemble-chunks where the invoking profile-id differs from the profile-id that created the referenced upload-id.
  • Unexpected deletion of pending upload sessions belonging to users who did not initiate the deletion.
  • Files, fonts, or project imports appearing in a user's account with content lineage traceable to another tenant's upload activity.

Detection Strategies

  • Audit backend logs for assemble-chunks invocations and cross-reference the authenticated profile against the session owner recorded when the chunks were uploaded.
  • Query the upload-session table for sessions that were assembled by a different profile than the originator, including sessions that were deleted immediately after cross-profile assembly.
  • Alert on repeated enumeration patterns against the assemble-chunks endpoint with varying upload-id values from a single authenticated session.

Monitoring Recommendations

  • Enable verbose RPC logging on binfile and fonts command handlers in Penpot deployments running versions prior to 2.18.0.
  • Forward Penpot application logs to a centralized logging platform and build dashboards that correlate upload-session creation and assembly events by profile.
  • Monitor for unusually fast import or file-creation activity following upload-session completion events owned by other profiles.

How to Mitigate CVE-2026-105695

Immediate Actions Required

  • Upgrade Penpot to version 2.18.0 or later, which applies profile scoping to the assemble-chunks lookup.
  • Rotate any shared or exposed upload-session identifiers and invalidate long-lived pending sessions after the upgrade.
  • Review access logs for the window preceding the upgrade to identify potential cross-profile assembly activity.

Patch Information

The fix is included in Penpot 2.18.0. The upstream change is documented in Pull Request #11012 and commit 367e4d5. Additional context is published in the GitHub Security Advisory GHSA-5vrm-3c6w-gjfv.

Workarounds

  • Restrict access to the Penpot instance to trusted authenticated users until the upgrade is applied, reducing the pool of accounts that could exploit the flaw.
  • Shorten upload-session lifetimes and purge pending sessions aggressively to reduce the window in which a session UUID can be hijacked.
  • Place the Penpot API behind a reverse proxy that logs full RPC request bodies, enabling forensic reconstruction of assemble-chunks invocations.
bash
# Upgrade self-hosted Penpot to the patched release
docker compose pull
docker compose down
# Pin the patched image tag in docker-compose.yaml, for example:
#   image: penpotapp/backend:2.18.0
docker compose up -d

# Verify the running backend version
docker compose exec penpot-backend sh -c 'echo $PENPOT_VERSION'

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Sources: National Vulnerability Database, CISA KEV, Exploit-DB

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne