CVE-2026-26202
📋 TL;DR
An authenticated user with team edit permissions in Penpot can read arbitrary files from the server filesystem by exploiting a path traversal vulnerability in the font upload functionality. This allows access to sensitive system files, configuration files, and secrets. All Penpot instances running versions before 2.13.2 are affected.
💻 Affected Systems
- Penpot
📦 What is this software?
Penpot by Kaleidos
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through exposure of database credentials, private keys, and application secrets, potentially leading to data exfiltration, lateral movement, or ransomware deployment.
Likely Case
Exposure of sensitive configuration files, environment variables, and application secrets that could enable further attacks or data breaches.
If Mitigated
Limited to reading files accessible to the Penpot process within container boundaries, still exposing container secrets and configuration.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. The vulnerability is publicly documented with technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.13.2
Vendor Advisory: https://github.com/penpot/penpot/security/advisories/GHSA-xp3f-g8rq-9px2
Restart Required: Yes
Instructions:
1. Backup your Penpot instance. 2. Update to version 2.13.2 or later. 3. Restart the Penpot service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict user permissions
allTemporarily remove team edit permissions from non-essential users to limit attack surface
Network segmentation
allIsolate Penpot instances from sensitive systems and limit network access
🧯 If You Can't Patch
- Implement strict access controls and monitor for suspicious font upload activities
- Deploy WAF rules to block requests containing path traversal patterns in font upload endpoints
🔍 How to Verify
Check if Vulnerable:
Check if Penpot version is below 2.13.2. Review logs for suspicious font upload requests containing file paths like /etc/passwd.Check Version:
Check Penpot admin interface or application logs for version informationVerify Fix Applied:
Confirm version is 2.13.2 or higher. Test that font uploads with path traversal payloads are rejected.📡 Detection & Monitoring
Log Indicators:
- Requests to /api/rpc/create-font-variant with file paths containing ../ or absolute paths
- Unusual font upload activities from authenticated users
Network Indicators:
- HTTP POST requests to font upload endpoints with suspicious payloads
SIEM Query:
source="penpot-logs" AND (uri_path="/api/rpc/create-font-variant" AND (request_body LIKE "%/etc/%" OR request_body LIKE "%..%"))