CVE-2026-45806

CVE-2026-45806 Penpot's remote image import let an authenticated file editor turn a normal media convenience feature into backend-origin SSRF because attacker-controlled URLs crossed into a redirect-following server fetch path without destination filtering. Intro I found this issue while reviewin...