7 matches found
CVE-2026-17613
Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...
EUVD-2026-53386
Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...
CVE-2026-17613 CVE-2026-17613
Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...
CVE-2026-17613
The Penpot application contains a vulnerability in the ::import-binfile RPC command due to a lack of authorization on the optional file-id parameter. This flaw allows any authenticated user to overwrite arbitrary files on the target server and subscribe to WebSocket events. The practical conseque...
CVE-2026-17613 CVE-2026-17613
Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...
PT-2026-68179
Name of the Vulnerable Software and Affected Versions Penpot affected versions not specified Description The ::import-binfile RPC command lacks proper authorization for the optional file-id parameter. This flaw allows any authenticated user to overwrite files on the target server and subscribe to...
CVE-2026-17613: Missing Authorization
Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...