CVE-2026-105694

Executive Summary

CVE-2026-105694 is a stored cross-site scripting vulnerability in Penpot, an open-source design and prototyping platform. Authenticated users with file-edit permission can upload SVG media containing scripts, event-handler attributes, or foreignObject elements that Penpot stores without sanitization and serves as image/svg+xml from the Penpot origin. When a victim navigates to the uploaded asset URL, attacker-controlled JavaScript executes in the Penpot origin with the victim's session authority, enabling session-scoped data access and requests. Penpot versions prior to 2.18.0 are affected; version 2.18.0 fixes the issue.

Technical Analysis

The vulnerability class is stored cross-site scripting (CWE-79) realized through active content embedded in uploaded SVG media. According to the NVD description, Penpot — prior to 2.18.0 — accepts SVG media uploads from authenticated users who hold file-edit permission. The application stores these SVGs without sanitization and subsequently serves them from the Penpot origin with the media type image/svg+xml.

The attack surface is the media upload and asset retrieval functionality of the Penpot platform. The key technical elements, stated in the description, are:

• Injection vector: An authenticated user with file-edit permission uploads an SVG file.
• Unsanitized content: Scripts, event-handler attributes, and foreignObject elements within the SVG are not stripped or neutralized during storage.
• Delivery context: The stored asset is served as image/svg+xml directly from the Penpot origin. Because SVG documents are active content, embedded scripts and event handlers can execute when the browser renders the document under this content type.
• Same-origin exposure: Execution occurs in the Penpot origin, meaning the executing script inherits the victim's authenticated session context for that origin.

Because the asset is served from the same origin as the application, the browser's same-origin policy does not provide a boundary between the malicious SVG and Penpot's application endpoints. The description states this allows "requests and data access with the victim's Penpot session authority." No further implementation details — such as specific endpoint paths, sanitization library behavior, or exact storage paths — are available in the provided data, and none are asserted here.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N quantifies the flaw: network-reachable (AV:N), low attack complexity (AC:L), requires low privileges — i.e., an authenticated account with file-edit permission (PR:L), requires user interaction as the victim must navigate to the asset URL (UI:R), and the scope is changed (S:C) because execution crosses from the media context into the application origin. Confidentiality and integrity impacts are Low (C:L/I:L), and availability impact is None (A:N), consistent with a stored XSS that enables session-scoped data access and requests rather than full system compromise.

Per the provided data, no public proof-of-concept, exploit code, or Nuclei template exists (POC_STATUS: None). The exploitation mechanism described below is therefore inferred from the vulnerability class and the explicit behaviors documented in the NVD description.

Exploitation Scenarios

The following attack chain is derived strictly from the NVD description and the vulnerability class; no specific function names, endpoints, or code constructs beyond those in the description are assumed.

1. Reconnaissance / target identification. An attacker identifies a Penpot deployment (pre-2.18.0) to which they can obtain an authenticated account. Evidence of a Penpot instance can be gathered from its login interface, page content, or favicon using the Shodan dorks provided. Required access level is an account with file-edit permission — i.e., the ability to create or edit files on the target instance.

2. Trigger of the flaw class. Using the authenticated file-edit account, the attacker uploads an SVG media file that contains active content — a script element, an event-handler attribute, or a foreignObject element. Per the description, Penpot stores these elements without sanitization. No vulnerability in the upload authentication flow is required; the precondition is a legitimate account with file-edit permission.

3. Payload / execution method (class level). The malicious asset is stored and later served from the Penpot origin with the image/svg+xml content type. When a victim navigates to the asset URL, the browser parses the SVG as active content and executes the embedded JavaScript. Because delivery originates from the Penpot origin, the script runs in that origin. No specific URL structure or parameter is asserted here beyond "the asset URL" as stated in the description.

4. Post-exploitation impact. With JavaScript executing in the Penpot origin under the victim's session, the attacker can issue requests and access data with the victim's Penpot session authority, as stated in the description. This may include acting on the application as the victim, reading data the victim can access, and performing state-changing operations permitted to the victim's account. The CVSS vector limits assessed confidentiality and integrity impact to Low and availability impact to None, but the scope change (S:C) reflects that the malicious script can affect resources beyond the original media component.

No public exploit exists per the provided data. The attack chain above is inferred from the vulnerability class and the documented storage-and-serving behavior.

Impact Assessment

Affected systems. Penpot deployments running versions prior to 2.18.0 that allow authenticated users with file-edit permission to upload SVG media and that serve stored assets from the application origin.

Blast radius. The immediate blast radius is per-victim: any user of the Penpot instance who navigates to a poisoned asset URL while authenticated. Because execution occurs in the Penpot origin, the attacker can act with the victim's session authority and access data the victim can access. Users with higher privileges who view the asset expand the effective impact. The scope is changed (S:C): the vulnerability in the media handling component can affect the broader application origin and its data.

CVSS subscores and interpretation. With AV:N the attack is network-deliverable. AC:L indicates no special conditions beyond those described. PR:L reflects that the attacker needs an authenticated file-edit account. UI:R reflects that a victim must navigate to the asset URL. C:L and I:L bound the confidentiality and integrity impact, while A:N indicates no availability impact. The base score is 5.4 (Medium).

Business impact. For internal design and collaboration deployments, this flaw allows an authenticated low-privilege user to target colleagues and potentially access or modify data within their sessions, supporting lateral movement within the application's trust boundary. Because the asset is served from the Penpot origin itself, browser-based same-origin protections do not isolate the payload from the application.

CISA KEV. Not listed in CISA KEV. EPSS. Not yet scored by FIRST.org; no value is asserted.

Detection Guidance

Sigma Rule

title: Penpot SVG Upload Containing Active Content (CVE-2026-105694)
id: 8b0f4c1a-1056-94a7-9f3e-4a6c1d2e7b55
status: experimental
description: Detects upload of SVG media containing script, event-handler, or foreignObject content in Penpot prior to 2.18.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105694
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_upload:
    http.method: 'POST'
    http.url|contains: 'upload'
  selection_type:
    http.content_type|contains: 'svg'
  selection_content:
    http.request_body|contains:
      - '<script'
      - 'onload='
      - 'onerror='
      - 'foreignObject'
  condition: selection_upload and selection_type and selection_content
falsepositives:
  - Legitimate SVG uploads referencing foreignObject for layout purposes
level: medium
tags:
  - attack.t1190
  - cwe.79
  - cve.2026-105694

YARA Rule

rule CVE_2026_105694_Penpot_SVG_XSS
{
    meta:
        description = "Detects SVG files containing active content consistent with CVE-2026-105694 stored XSS in Penpot"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105694"
        cve = "CVE-2026-105694"

    strings:
        $svg = "<svg" nocase ascii
        $script = "<script" nocase ascii
        $onload = "onload" nocase ascii
        $onerror = "onerror" nocase ascii
        $onclick = "onclick" nocase ascii
        $foreign = "foreignObject" nocase ascii

    condition:
        $svg and (
            $script or
            $onload or
            $onerror or
            $onclick or
            $foreign
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105694 Penpot SVG Upload With Active Content"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"<svg"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"foreignObject"; nocase; sid:10569401; rev:1; metadata:cve CVE-2026-105694, attack.t1190; classtype:web-application-attack;)

Elastic Detection

sequence by user.name, host.name with maxspan=5m
  [ network where event.action == "network" and
      http.request.method == "POST" and
      http.request.body.content : ("<svg*" and ("<script*" or "*onload=*" or "*onerror=*" or "*foreignObject*")) ]

Splunk SPL Query

index=web OR index=proxy
(http.method=POST OR method=POST)
(http.request_body="*<svg*" OR content_type="*svg*")
(http.request_body="*<script*" OR http.request_body="*onload=*" OR http.request_body="*onerror=*" OR http.request_body="*foreignObject*")
| stats count min(_time) as first_seen max(_time) as last_seen values(http.request_body) as payload by src_ip, http.url
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,penpot,">
  <rule id="105694" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>upload</url>
    <description>CVE-2026-105694: Penpot SVG upload containing active content (script/foreignObject/event handler)</description>
    <match>svg</match>
    <regex>&lt;script|onload=|onerror=|foreignObject</regex>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_105694,cwe_79,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Upgrade to Penpot 2.18.0, which per the NVD description fixes the issue.
   • Where immediate upgrade is not possible, restrict the ability to upload SVG media to trusted accounts, and/or sanitize SVG uploads at a reverse proxy or application gateway to strip <script>, event-handler attributes (e.g., onload, onerror), and foreignObject elements before storage.
   • Serve user-uploaded media from a separate, non-authenticated origin or with a restrictive Content-Security-Policy and, where feasible, a Content-Disposition that forces download rather than inline rendering. Note: no vendor-provided workaround is documented in the available data.
   • Deploy the detection rules above to identify attempted uploads of SVGs containing active content.

2. Patch / upgrade steps.

   • Upgrade Penpot to version 2.18.0 or later.
   • Verify the deployed version after upgrade.
   • Review previously uploaded SVG assets for embedded active content and remove or re-sanitize any that are found.

3. Long-term hardening.

   • Implement server-side SVG sanitization as a standard control for all media uploads, treating SVG as active content rather than a passive image format.
   • Adopt a Content Security Policy for the Penpot origin that blocks inline script execution.
   • Apply least privilege to file-edit permissions to reduce the set of accounts that can introduce stored active content.
   • Monitor and re-score as EPSS and CISA KEV statuses are published; currently EPSS is not yet scored and the CVE is not in CISA KEV.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105694
• Penpot project: https://penpot.app
• Penpot source repository: https://github.com/penpot/penpot
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template is available per the provided data. No threat actor campaigns or exploit-in-the-wild evidence are documented for CVE-2026-105694 at this time.