CVE-2026-26202
Arbitrary File Read in Penpot via create-font-variant RPC
Publication date: 2026-02-19
Last updated on: 2026-02-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kaleidos | penpot | to 2.13.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
Can you explain this vulnerability to me?
This vulnerability exists in Penpot, an open-source design tool. Before version 2.13.2, an authenticated user with team edit permissions could exploit the create-font-variant RPC endpoint by supplying a local file path (such as /etc/passwd) as font data. This allowed the user to read arbitrary files from the server's filesystem. The contents of these files would then be stored and retrievable as a font asset.
Essentially, this is an arbitrary file read vulnerability that lets an attacker access sensitive files on the server where Penpot is running.
How can this vulnerability impact me? :
The vulnerability can lead to exposure of sensitive system files, application secrets, database credentials, and private keys. This exposure can potentially enable further compromise of the server hosting Penpot.
In containerized environments, the impact might be limited to the container's filesystem, but environment variables, mounted secrets, and application configuration remain at risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Penpot to version 2.13.2 or later, which contains a patch for the arbitrary file read issue.
Additionally, restrict authenticated user permissions to only those necessary, especially limiting team edit permissions to trusted users.
In containerized deployments, consider limiting access to sensitive files and secrets within the container filesystem to reduce potential impact.