CVE-2026-105689 in Penpot
Summary
by MITRE • 10/06/2026
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT64 gateway or an attacker-controlled DNS AAAA record; cloud environments with NAT64 gateways are directly exploitable. A user controlling a media import URL, or an administrator controlling a webhook URL, can then supply an IPv6 transition address that embeds a cloud-metadata, loopback, link-local, or private IPv4 target and bypasses the intended SSRF restrictions. Media import can disclose response bodies, while webhook delivery can expose response status as a network-probing side channel. This issue is fixed in version 2.18.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Penpot prior to version 2.18.0 represents a significant Server-Side Request Forgery (SSRF) flaw rooted in the application's handling of IPv6 address validation logic. The core technical deficiency lies within the app.util.ssrf/blocked-address function, which relies on Java InetAddress predicates for determining whether an IP address is private or reserved. This implementation fails to correctly classify specific IPv6 transition mechanisms, specifically NAT64, 6to4, and Teredo addresses. Furthermore, the validation logic applies additional Classless Inter-Domain Routing CIDR checks exclusively to IPv4 values, leaving a gap in the security controls for IPv6 traffic. Because these transition addresses are designed to embed or translate IPv4 addresses within an IPv6 format, they can be crafted to represent internal cloud metadata endpoints, loopback interfaces, link-local addresses, or private network ranges while appearing as valid public IPv6 addresses to naive validation routines.
Exploitation of this vulnerability requires the attacker to manipulate DNS resolution or network routing paths to leverage these transition mechanisms. Specifically, an attacker must route requests through a NAT64 gateway or configure an attacker-controlled Domain Name System AAAA record that resolves to one of these vulnerable IPv6 formats. In cloud environments where NAT64 gateways are enabled for hybrid connectivity, this condition is often met by default, making such deployments directly exploitable without complex network manipulation from the external internet. The vulnerability affects two primary attack vectors within Penpot: media import functionality and webhook delivery systems. A user with the ability to control a media import URL can trigger an SSRF request that bypasses the IP blocklist, while an administrator controlling a webhook URL faces similar risks when configuring target endpoints for event notifications.
The operational impact of this flaw is twofold, depending on which vector is exploited. When leveraging the media import feature, successful exploitation allows an attacker to disclose response bodies from internal services. This can lead to the exposure of sensitive configuration data, authentication tokens, or proprietary design assets stored within the organization's private network infrastructure. In scenarios involving webhook delivery, the vulnerability serves as a powerful network-probing side channel. Although this vector may not directly reveal full response payloads in all configurations, it allows an attacker to determine the reachability and status of internal services by observing HTTP response codes. This capability facilitates reconnaissance against cloud metadata endpoints such as AWS EC2 instance metadata service or Azure managed identity endpoints, potentially leading to further credential theft and lateral movement within the compromised environment.
This vulnerability is categorized under CWE-918 Server-Side Request Forgery (SSRF) due to its ability to allow an attacker to make requests from the server's perspective to internal resources that should be inaccessible. Additionally, it aligns with MITRE ATT&CK technique T1046 Network Service Discovery, as the webhook-based side channel enables attackers to map out and identify live services within a private network segment. The root cause is classified under CWE-289 Authentication Bypass by IP Address Restriction because the validation logic fails to properly restrict access based on the true nature of the destination address when IPv6 transition techniques are employed. To mitigate this risk, organizations must upgrade Penpot to version 2.18.0 or later, where the developers have corrected the InetAddress predicates and expanded CIDR checks to encompass IPv6 addresses including NAT64, 6to4, and Teredo formats. Until upgrading is possible, administrators should restrict outbound network access from Penpot servers using firewall rules that block connections to known cloud metadata IP ranges and internal private subnets, thereby providing a compensating control against the SSRF exploitation path.