CVE-2026-105686

Executive Summary

CVE-2026-105686 is a resource allocation flaw in Penpot, an open-source design and prototyping platform. Prior to version 2.18.0, the chunked media upload RPC validates that a supplied chunk index falls within an allowed range, but fails to reject a chunk index that has already been stored and fails to replace the previously stored object for that index. An authenticated user can therefore repeatedly upload the same valid chunk index, and each successful request allocates an additional temporary object. This drives stored bytes beyond the logical size declared for the upload session, producing a storage-exhaustion condition on the affected Penpot instance (CWE-770: Allocation of Resources Without Limits or Throttling). The vendor has addressed the issue in Penpot 2.18.0; no public proof-of-concept, exploit code, or Nuclei template is currently available, and the CVE has not been scored by NVD or FIRST.org EPSS at the time of writing.

Technical Analysis

The vulnerability resides in Penpot’s chunked media upload remote procedure call (RPC) path. Chunked uploads are a standard mechanism for transmitting large binary objects: the client splits a file into ordered segments, each identified by a chunk index, and submits them individually. The receiving server is expected to enforce two invariants. First, each index must fall within the declared range for the session (for example, between zero and the total chunk count minus one). Second, each index must map to exactly one stored object, so that a repeated upload of the same index either overwrites the prior object or is rejected outright.

According to the CVE description, the Penpot implementation prior to 2.18.0 enforces only the first invariant: “the chunked media upload RPC validates that a chunk index is in range.” The second invariant is not enforced in either of its acceptable forms — the server “neither rejects an already stored index nor replaces its previous object.” Because the code path performs an unconditional allocation of a new temporary object for every request that passes the range check, a client can submit the same valid index repeatedly and accumulate a distinct stored object each time.

This yields a mismatch between the session’s declared logical size and the storage actually consumed. The upload session advertises a fixed byte budget based on the expected chunk count and chunk size, but the physical bytes persisted on the backend grow with each duplicate submission. Critically, the description notes that “assembly detects the inconsistent chunk count only after allocation.” Consequently, whatever integrity check exists at finalization time happens too late: the temporary objects have already been written, and any cleanup must reconcile a set of allocations that were never bounded by the declared logical size. If cleanup is incomplete, incomplete, or asynchronous, the excess bytes persist.

The root cause is a missing idempotency and uniqueness constraint on chunk index handling, classified as CWE-770, Allocation of Resources Without Limits or Throttling. The flaw is post-authentication (PR:L), network-reachable (AV:N), and requires no user interaction (UI:N). No code-level identifiers, function names, or endpoint paths are disclosed in the available description, so the precise method signature and storage backend remain unspecified.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-105686. The following chain is inferred strictly at the vulnerability-class level from the NVD description and must be read as such.

1. Reconnaissance and target identification. An adversary locates a reachable Penpot deployment, for example by searching for internet-exposed instances using Shodan dorks targeting Penpot page titles or HTML content. The attacker confirms the instance hosts a Penpot version earlier than 2.18.0, since the flaw was corrected in 2.18.0.

2. Access establishment. The attack requires an authenticated user, per the CNA description. The adversary obtains valid credentials — through a legitimate account, a trial registration, or credential reuse — and authenticates to the Penpot instance. No privileged role is described as necessary.

3. Triggering the flaw class. Using the authenticated session, the adversary initiates a chunked media upload and then repeatedly submits the same valid chunk index. The upload RPC accepts each request because the index is in range, and because the code neither rejects an already-stored index nor overwrites the previous object, every duplicate submission allocates another temporary object. Repeated iteration amplifies the imbalance between declared logical size and actual stored bytes.

4. Post-exploitation impact. Storage consumption grows in proportion to the number of duplicate submissions. Because assembly detects the inconsistent chunk count only after allocation has already occurred, the temporary objects exist before any integrity response. Sustained repetition against one or more upload sessions can exhaust backend storage capacity, degrading or denying the service for all tenants of the instance. No data confidentiality or integrity impact is described; the outcome is availability-focused resource exhaustion.

Impact Assessment

The impact is a denial-of-service condition caused by unbounded resource allocation on an authenticated, network-reachable attack surface. Affected systems are self-hosted or cloud-hosted Penpot deployments running any version prior to 2.18.0. The blast radius is the entire instance: because uploaded media chunks are stored centrally, exhaustion of the backing storage affects all users, projects, and teams served by that deployment, not only the attacker’s account. Multi-tenant or shared-infrastructure deployments face the most severe consequences, as a single authenticated account is sufficient to consume shared capacity.

CVSS scoring is not available from NVD for this CVE, and FIRST.org has not yet assigned an EPSS value. A reasonable vector consistent with the described mechanism is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, reflecting network exploitability, low attack complexity, required low privileges, no user interaction, and availability-only impact localized to the affected service. The EPSS score should not be assumed; it is explicitly unscored. CISA KEV does not list this vulnerability, and there is no evidence of in-the-wild exploitation at the time of writing. Business impact centers on service downtime, cleanup labor to purge orphaned temporary objects, and potential upstream storage cost escalation in cloud-hosted environments.

Detection Guidance

Sigma Rule

title: Penpot Chunked Media Upload Duplicate Index Abuse
id: 7f4c1a2e-2b9d-4e77-9c31-aa1d2f6e5b10
status: experimental
description: Detects repeated chunked media upload RPC requests reusing the same chunk index for a single upload session, indicative of CVE-2026-105686 resource exhaustion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105686
author: SOC Detection Engineering
date: 2026/01/01
logsource:
  category: webserver
  product: penpot
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains: 'upload'
  timeframe: 5m
  condition: selection | count() by src_ip, cs-uri-stem > 20
falsepositives:
  - Legitimate retries after transient network failures
level: medium
tags:
  - attack.t1499
  - cve.2026.105686

YARA Rule

rule CVE_2026_105686_Penpot_Upload_Abuse
{
    meta:
        description = "Detects repeated chunked upload index reuse patterns in Penpot request logs (CVE-2026-105686)"
        author = "SOC Detection Engineering"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105686"
        date = "2026-01-01"
    strings:
        $a = "chunk" nocase
        $b = "upload" nocase
        $c = "index" nocase
        $d = "/api/rpc" nocase
    condition:
        any of ($a, $b) and $c and #a > 5
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105686 Penpot Chunked Upload Duplicate Index Abuse"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"upload"; nocase; content:"chunk"; nocase; threshold:type both, track by_src, count 20, seconds 300; classtype:attempted-dos; reference:cve,2026-105686; sid:2026105686; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "POST" and
      http.request.body.content : "*chunk*" ]
  [ network where network.protocol == "http" and http.request.method == "POST" and
      http.request.body.content : "*chunk*" ] : 2

Splunk SPL Query

index=web sourcetype=penpot_access
| search method=POST uri_path=*upload*
| eval session=coalesce(upload_session, uri_query)
| stats count values(chunk_index) as indices dc(chunk_index) as unique_indices by src_ip session
| where count > 20 AND unique_indices < count
| table _time src_ip session count unique_indices

Wazuh OSSEC Rule

<group name="penpot,web,attack,">
  <rule id="105686" level="10" frequency="20" timeframe="300">
    <if_matched_sid>31151</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-105686 - Possible Penpot chunked media upload abuse by same source IP (repeated duplicate chunk index).</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict internet exposure of Penpot instances to trusted networks or place them behind an authenticated reverse proxy. Apply per-account and per-session rate limits on the chunked media upload RPC at the reverse proxy or WAF layer, with a low threshold for repeated identical chunk index submissions. Cap total storage quotas per user and per upload session, and monitor for orphaned temporary object creation that exceeds declared session sizes.

2. Patch/upgrade steps. Upgrade to Penpot 2.18.0, the version in which the issue is fixed. Validate the deployed version after upgrade and confirm the upload RPC now rejects or replaces an already-stored chunk index rather than allocating a new object unconditionally. Because no vendor patch artifact is tracked in OSV or other sources for this CVE, verify directly against the Penpot 2.18.0 release artifacts and changelog before relying on the fix.

3. Long-term hardening. Implement idempotency keys for upload chunks so that repeated submissions of the same index converge to a single stored object. Enforce pre-allocation validation of chunk counts against declared logical size. Add automated cleanup reaping of orphaned temporary objects with alerting on anomalous allocation growth. Integrate storage-consumption anomalies into continuous monitoring and track Penpot advisories for future revisions of this fix.

References

• NVD — CVE-2026-105686: https://nvd.nist.gov/vuln/detail/CVE-2026-105686
• Penpot GitHub project and release history: https://github.com/penpot/penpot
• Penpot official documentation and downloads: https://penpot.app
• CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-105686 at the time of writing. The CVE is not listed in CISA KEV, and no public proof-of-concept or Nuclei template is available.