CVE-2026-105694 in Penpot
Summary
by MITRE • 10/06/2026
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A victim who navigates to the asset URL executes attacker-controlled JavaScript in that origin, allowing requests and data access with the victim's Penpot session authority. This issue is fixed in version 2.18.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Penpot prior to version 2.18.0 represents a critical server-side input validation failure within an open-source design and prototyping platform. The core technical flaw lies in the insufficient sanitization of Scalable Vector Graphics (SVG) files uploaded by authenticated users who possess file-edit permissions. When these users upload SVG media, the application fails to strip or neutralize potentially malicious content embedded within the vector format. Specifically, the system allows the storage and subsequent serving of SVG elements that contain executable JavaScript scripts, event-handler attributes such as onload or onclick, and foreignObject tags which can encapsulate HTML content. This lack of rigorous input filtering means that arbitrary code execution payloads are preserved in their original form rather than being sanitized into safe static image data.
From an operational perspective, the impact of this vulnerability is severe due to the manner in which Penpot serves these assets. The platform incorrectly serves the uploaded SVG files with the MIME type application/svg+xml from the same origin as the main web application. This configuration choice is pivotal because it causes modern browsers to interpret and execute any embedded JavaScript within the context of the Penpot domain, rather than treating the file as a static image resource. Consequently, an attacker who successfully uploads a malicious SVG can trigger cross-site scripting (XSS) attacks against other users or themselves if they navigate directly to the asset URL. The execution occurs in the security context of the Penpot origin, granting the injected script full access to cookies, local storage, and session tokens associated with that domain.
The exploitation scenario typically involves an attacker crafting a malicious SVG file containing JavaScript code designed to exfiltrate sensitive data or perform actions on behalf of the victim. If another user with appropriate permissions views this asset within the Penpot interface, or if the attacker directly accesses the served URL while logged in, the browser executes the script. This allows for session hijacking, where the attacker can steal the victim's authentication cookies to impersonate them. It also enables data theft, as the malicious script can read sensitive design files and metadata stored within the application. Furthermore, because the execution happens on the Penpot origin, it bypasses same-origin policy protections that would otherwise restrict cross-domain attacks, effectively turning a file upload feature into a vector for complete account compromise.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). More specifically, it falls under the category of Stored XSS because the malicious payload is saved on the target server and later served to users. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, particularly through JavaScript execution in a browser environment. The attack vector leverages the trust relationship between the user's session and the application origin, exploiting the platform's failure to distinguish between safe image data and executable code within SVG formats.
To mitigate this vulnerability, organizations must ensure that Penpot is updated to version 2.18.0 or later, where the issue has been resolved through improved input validation and sanitization processes. For environments unable to patch immediately, defensive measures should include implementing strict Content Security Policy headers that restrict script execution from specific origins or disable inline scripts entirely. Additionally, configuring web servers to serve uploaded SVG files with a content-disposition header set to attachment can force browsers to download the file rather than render it, preventing automatic execution of embedded JavaScript. Regular security audits focusing on media upload functionalities and strict adherence to whitelist-based validation for allowed SVG tags are essential practices to prevent similar vulnerabilities in future development cycles.