CVE-2026-105695
Deferred Deferred - Pending Action

Session Fixation in Penpot Design Platform

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed upload-session UUID can assemble the victim's chunks into the attacker's own file, team font, or project import, disclosing the uploaded bytes and deleting the victim's pending session. This issue is fixed in version 2.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-06
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-105695
EUVD
EUVD-2026-92714

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
penpot penpot < 2.18.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Penpot before version 2.18.0 has a flaw in the upload session handling. The assemble-chunks function retrieves upload sessions using only a session ID without checking if the user owns it. An attacker with another user's valid session ID can assemble the victim's uploaded chunks into their own file, team font, or project import. This exposes the victim's uploaded data and deletes their pending session.

Detection Guidance

This vulnerability can be detected by checking the Penpot version in use. If your system runs a version prior to 2.18.0, it is vulnerable. Use commands like 'docker ps' or 'penpot version' to verify the installed version.

Impact Analysis

If you use Penpot before 2.18.0, an attacker with your upload session ID could access your uploaded files or data. They could also delete your pending upload session, disrupting your work. Upgrading to version 2.18.0 or later prevents this issue.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations must ensure proper access controls and apply security updates to maintain compliance.

Mitigation Strategies

Upgrade Penpot to version 2.18.0 or later immediately. Review user sessions and file uploads for unauthorized access. Monitor for unusual file assembly or deletion activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105695. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart