CVE-2026-45806: Penpot SSRF Vulnerability

CVE-2026-45806 Overview

CVE-2026-45806 is a Server-Side Request Forgery (SSRF) vulnerability in Penpot, an open-source design and code collaboration tool. The flaw affects Penpot versions prior to 2.15.0. The remote image import feature accepts a user-controlled URL from the frontend and passes it to the backend :create-file-media-object-from-url RPC method. The backend media/download-image function issues the outbound HTTP request without destination filtering. An authenticated file editor can abuse this to reach internal-only endpoints reachable from the Penpot backend host. The vulnerability is tracked as [CWE-918] and is fixed in Penpot 2.15.0.

Critical Impact
An authenticated Penpot editor can coerce the backend into issuing HTTP requests to internal network services, exposing metadata endpoints, internal APIs, and other non-public resources.

Affected Products

Penpot versions prior to 2.15.0
Self-hosted Penpot instances exposing the workspace RPC API
Penpot deployments running the shared HTTP client in backend/src/app/media.clj

Discovery Timeline

2026-07-15 - CVE-2026-45806 published to NVD
2026-07-15 - Last updated in NVD database
Fixed in - Penpot release 2.15.0

Technical Details for CVE-2026-45806

Vulnerability Analysis

The vulnerability originates in Penpot's remote image import workflow. The frontend module frontend/src/app/main/data/workspace/media.cljs accepts a URL from the workspace UI. This URL is forwarded to the backend RPC command :create-file-media-object-from-url defined in backend/src/app/rpc/commands/media.clj. The backend invokes media/download-image in backend/src/app/media.clj, which uses a shared HTTP client to fetch the remote resource. The client performs no destination validation, so requests targeting private IP ranges, loopback addresses, or internal DNS names are executed by the backend process.

Root Cause

The root cause is missing destination filtering on server-issued HTTP requests. The download-image helper trusts the caller-supplied URL and does not enforce an allow-list of external destinations. It also does not block RFC 1918 addresses, link-local ranges, 127.0.0.0/8, or cloud metadata endpoints such as 169.254.169.254. Because the request originates from the backend, it inherits the network position of the Penpot server rather than the authenticated user.

Attack Vector

An authenticated user with file editor permissions triggers an image import and supplies a URL pointing to an internal resource. The backend issues the request and processes the response as image data. Attackers can enumerate internal services, probe metadata APIs on cloud instances, or interact with unauthenticated HTTP endpoints on the internal network. See the GitHub Security Advisory GHSA-35g2-w7f6-8v9h for additional detail.

No verified public proof-of-concept code has been published. The advisory identifies the vulnerable code paths in media.cljs, media.clj, and download-image without providing exploitation samples.

Detection Methods for CVE-2026-45806

Indicators of Compromise

Backend HTTP requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) originating from the Penpot service account.
Outbound requests from the Penpot backend to 169.254.169.254 or other cloud metadata endpoints.
Repeated :create-file-media-object-from-url RPC calls from a single user targeting unusual hostnames or IPs.

Detection Strategies

Inspect Penpot backend logs for download-image invocations with URLs referencing internal hostnames or non-public IP addresses.
Correlate RPC call volume for :create-file-media-object-from-url with anomalous destination diversity per user session.
Enable egress firewall logging on the Penpot backend and alert on connections to internal subnets not required for normal operation.

Monitoring Recommendations

Forward Penpot application logs and network flow data to a centralized log platform for correlation across users and destinations.
Monitor for outbound HTTP responses returned to workspace clients that contain non-image content types.
Track failed image imports paired with successful backend connections, which can indicate reconnaissance against internal services.

How to Mitigate CVE-2026-45806

Immediate Actions Required

Upgrade all Penpot instances to version 2.15.0 or later, as documented in the Penpot 2.15.0 release notes.
Restrict egress network access from the Penpot backend to only the destinations required for remote image fetching.
Review audit logs for prior use of the remote image import feature and validate that no internal endpoints were accessed.

Patch Information

The issue is fixed in Penpot 2.15.0. The release adds destination filtering to the shared HTTP client used by media/download-image, preventing the backend from issuing requests to internal-only endpoints. Refer to the GitHub Security Advisory GHSA-35g2-w7f6-8v9h for the full advisory and remediation guidance.

Workarounds

Block egress from the Penpot backend container or host to RFC 1918 ranges, loopback, and cloud metadata addresses using network policies or firewall rules.
Place the Penpot backend behind an outbound HTTP proxy that enforces an allow-list of permitted external image hosts.
Limit the file editor role to trusted users until the upgrade to 2.15.0 is complete.

bash

# Example egress restriction using iptables on the Penpot backend host
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT