Security Advisory
CVE-2026-17613
7.5
HIGH
Vulnerability Description
Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.
Published Date
August 5, 2026
Official Source
NIST NVD Advisory