Unrated severityNVD Advisory· Published Aug 5, 2026· Updated Aug 5, 2026

CVE-2026-17613

Description

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.

Affected products

Penpot/Penpotllm-fuzzy

Patches

Vulnerability mechanics

References

github.com/penpot/penpot/releases/tag/2.17.0mitre
penpot.appmitre
vokecyber.com/blog/cve-2026-17613-penpot-cross-team-file-takeovermitre
vokecyber.com/research/cve-2026-17613-penpot-cross-team-file-takeovermitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000