Penpot patches cross-team file takeover (CVE-2026-17613, GHSA-8qqw-wm58-45v7) in 2.18.0 as PoC goes public
Maintainers of the open-source design platform Penpot have fixed a cross-team file takeover flaw in the import-binfile RPC command, tracked as GHSA-8qqw-wm58-45v7 / CVE-2026-17613, after full technical details and proof-of-concept exploit code were published. The bug lets any authenticated user overwrite any file on the instance by supplying a victim file UUID, and re-parents that file into the attacker's project, transferring effective ownership. It was reported by Louis Sanchez of Voke Cyber on 2026-05-28 and, after no vendor response, coordinated through CERT/CC as VU#241166, with the CVE assigned on 2026-07-06 (vokecyber.com); researcher rbrents3000 later reported the same import bug independently as GHSA-whxm-54w3-qr7w. Severity is disputed: the GitHub advisory header shows CVSS 9.9 Critical, while the CVE record, NVD and CISA ADP all carry CVSS v3.1 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (cve.circl.lu, osv.dev). Exploitation requires an account on the instance — a condition trivially met where open self-registration is left on, the default — and no in-the-wild attacks have been confirmed.
Entenda a falha
A vulnerabilidade
Penpot, the open-source design platform, has a missing-authorization flaw (GHSA-8qqw-wm58-45v7, CVE-2026-17613) in the import-binfile RPC command of its Clojure backend. Any authenticated user can overwrite any file on the instance by supplying the victim's file UUID, and the file is moved into the attacker's project, so the attacker effectively owns it. Open self-registration, which is the default, makes the account requirement easy to meet. Severity is disputed: the GitHub advisory shows CVSS 9.9, while the CVE record, NVD and CISA ADP show 7.5 High. A bundled second flaw (CVSS 7.7 in the public report) lets any logged-in user subscribe to file and team WebSocket streams without an access check. Versions 1.20 through 2.17.1 are affected; 2.18.0 fixes both.
Como funciona
A logged-in user calls the import-binfile RPC route with a binary file to import and a project-id. The server checks that the caller can edit that project. The route also accepts an optional file-id parameter. When it is present, the handler switches to in-place overwrite mode and fetches the file by ID alone, with no team or project scope. It then writes the uploaded data into that existing row and changes its project-id to the caller's project. The victim loses the design and cannot use the restore tool. If the file is a shared library, linked files in other teams pull the attacker's content on the next sync. In the WebSocket service, the subscribe-file and subscribe-team handlers accept any UUID and start streaming live edits, cursor movement and role changes.
Por que é vulnerável
The root causes are CWE-862 (Missing Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key). The handler validated only the caller's rights over their own project-id and never checked that the user-supplied file-id belonged to them. The database query also had no team or project filter. The file-id import feature arrived in version 1.20, and the flaw stayed in every release up to 2.17.1. The WebSocket handlers likewise trusted the target UUIDs without any access check. The fix removes the file-id field from the import-binfile schema and adds strict access checks to all WebSocket file and team subscriptions.
Onde está
The import-binfile RPC command in the Penpot backend, specifically its schema's file-id parameter (issue #10993, fixed by PR #10994), and the WebSocket subscribe-file and subscribe-team handlers (fixed by PR #11069), all in the public penpot/penpot repository.
Como foi descoberta
Louis Sanchez of Voke Cyber reported the import bug and the related WebSocket flaw on 2026-05-28. The story says the vendor did not respond, so the report went through CERT/CC as VU#241166, and the CVE was assigned on 2026-07-06. Researcher rbrents3000 later reported the same import bug independently as GHSA-whxm-54w3-qr7w. Full details and exploit code were then published in the GitHub security advisory, and Penpot released 2.18.0 with the fixes. No in-the-wild exploitation has been confirmed.
PoC pública
The public report in the GitHub security advisory includes a working proof-of-concept exploit for the file takeover, and the articles say full technical details are public as well. It targets an authenticated attacker overwriting a victim file by UUID. No attacks in the wild have been confirmed, but a public working exploit makes patching to 2.18.0 urgent for any instance with open sign-ups.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 23:16.
Detalhes técnicos
The flaw combines CWE-862 (Missing Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key) in the Clojure backend. The import-binfile handler validates only that the caller can edit their own project-id, never that the optional file-id parameter belongs to them. Supplying a victim UUID triggers in-place overwrite mode: the database query fetches the file by ID with no team or project scope, writes the attacker's payload into the victim's row and changes its project-id to the attacker's project. The victim loses the design and cannot use the restore tool, while the attacker can read, edit, export or re-share it; if the hijacked file is a shared library, linked files in other teams pull the attacker's content on the next sync. A second, bundled issue (CVSS 7.7 per the public report) affects the WebSocket service, where the subscribe-file and subscribe-team handlers perform no access check on target UUIDs, letting any logged-in user watch live edits, cursor movement and team role changes. Affected builds run from v1.20, when the file-id import feature was added, through 2.17.1; the CVE record lists 1.20 up to 2.17.1 as affected (cve.circl.lu).
Detalhes da correção
Both issues are fixed in Penpot 2.18.0. The release notes list "Fix import-binfile RPC method schema accepting a file-id parameter #10993 (PR: #10994)", which removes the unsafe file-id field from the import schema, alongside a broader batch of backend authorization hardening — team-ownership validation on create-font-variant and on file library link endpoints, a fix for webhook endpoints allowing unauthorized access via a creator-id fallback, and limits on binfile parser allocation and Fressian reader recursion (github.com/penpot/penpot/releases/tag/2.18.0). PR #11069 adds strict access checks to all WebSocket file and team subscriptions. The 2.18.0 release was published on the project's GitHub releases page on 23 September (github.com/penpot/penpot).
Remediação
Upgrade self-hosted Penpot instances to 2.18.0 immediately, since exploit code is public. Until patched, disable open user self-registration and restrict network access to trusted staff. Review database and application logs for unexpected project-id changes on files across team boundaries, and treat every account on an unpatched instance as having write access to every file.
Linha do tempo
-
Penpot patches cross-team file takeover (CVE-2026-17613, GHSA-8qqw-wm58-45v7) in 2.18.0 as PoC goes public
ler a análise desta fonte ocultar
Maintainers of the open-source design platform Penpot have fixed a cross-team file takeover flaw in the
import-binfileRPC command, tracked as GHSA-8qqw-wm58-45v7 / CVE-2026-17613, after full technical details and proof-of-concept exploit code were published. The bug lets any authenticated user overwrite any file on the instance by supplying a victim file UUID, and re-parents that file into the attacker's project, transferring effective ownership. It was reported by Louis Sanchez of Voke Cyber on 2026-05-28 and, after no vendor response, coordinated through CERT/CC as VU#241166, with the CVE assigned on 2026-07-06 (vokecyber.com); researcher rbrents3000 later reported the same import bug independently as GHSA-whxm-54w3-qr7w. Severity is disputed: the GitHub advisory header shows CVSS 9.9 Critical, while the CVE record, NVD and CISA ADP all carry CVSS v3.1 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (cve.circl.lu, osv.dev). Exploitation requires an account on the instance — a condition trivially met where open self-registration is left on, the default — and no in-the-wild attacks have been confirmed.Technical Details
The flaw combines CWE-862 (Missing Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key) in the Clojure backend. The
import-binfilehandler validates only that the caller can edit their ownproject-id, never that the optionalfile-idparameter belongs to them. Supplying a victim UUID triggers in-place overwrite mode: the database query fetches the file by ID with no team or project scope, writes the attacker's payload into the victim's row and changes itsproject-idto the attacker's project. The victim loses the design and cannot use the restore tool, while the attacker can read, edit, export or re-share it; if the hijacked file is a shared library, linked files in other teams pull the attacker's content on the next sync. A second, bundled issue (CVSS 7.7 per the public report) affects the WebSocket service, where thesubscribe-fileandsubscribe-teamhandlers perform no access check on target UUIDs, letting any logged-in user watch live edits, cursor movement and team role changes. Affected builds run from v1.20, when thefile-idimport feature was added, through 2.17.1; the CVE record lists 1.20 up to 2.17.1 as affected (cve.circl.lu).Fix Details
Both issues are fixed in Penpot 2.18.0. The release notes list "Fix import-binfile RPC method schema accepting a file-id parameter #10993 (PR: #10994)", which removes the unsafe
file-idfield from the import schema, alongside a broader batch of backend authorization hardening — team-ownership validation oncreate-font-variantand on file library link endpoints, a fix for webhook endpoints allowing unauthorized access via acreator-idfallback, and limits on binfile parser allocation and Fressian reader recursion (github.com/penpot/penpot/releases/tag/2.18.0). PR #11069 adds strict access checks to all WebSocket file and team subscriptions. The 2.18.0 release was published on the project's GitHub releases page on 23 September (github.com/penpot/penpot).Remediation
Upgrade self-hosted Penpot instances to 2.18.0 immediately, since exploit code is public. Until patched, disable open user self-registration and restrict network access to trusted staff. Review database and application logs for unexpected
project-idchanges on files across team boundaries, and treat every account on an unpatched instance as having write access to every file.