CVE-2026-105695

Executive Summary

CVE-2026-105695 is an authorization flaw in Penpot, an open-source design and prototyping platform, affecting versions prior to 2.18.0. The assemble-chunks operation retrieves an upload session using only a session ID, whereas upload-chunk correctly scopes the lookup to the authenticated profile, meaning an authenticated attacker who obtains a victim's live, completed upload-session UUID can assemble the victim's uploaded bytes into their own file, team font, or project import. This results in disclosure of the victim's uploaded data (Confidentiality: High) and deletion of the victim's pending upload session (Availability: Low), yielding an overall CVSS v3.1 base score of 5.9.

Technical Analysis

The vulnerability is an instance of CWE-862 (Missing Authorization). At its core, the defect is an inconsistency between two related server-side operations that handle chunked uploads:

• upload-chunk — correctly scopes the upload-session lookup to the authenticated profile. In other words, when a chunk is uploaded, the server verifies that the upload session belongs to the calling user before writing the chunk.
• assemble-chunks — retrieves the upload session using only its session ID, without verifying that the session belongs to the authenticated profile.

This creates an object-level authorization (IDOR-style) condition specifically at the assembly step. The access-control check present in one endpoint of the same upload workflow is absent in the sibling endpoint that finalizes the workflow.

Because the lookup is performed solely by session ID at assembly time, the server does not validate ownership. An authenticated attacker who possesses a valid, live, and completed upload-session UUID belonging to another user can invoke the assembly operation against that session ID. The server then assembles the attacker-identified session's stored chunks and places the resulting file into a destination under the attacker's own context — described in the advisory as "the attacker's own file, team font, or project import." This both discloses the bytes the victim uploaded and removes (deletes) the victim's pending upload session as a side effect of assembly.

Key preconditions for exploitation:

• The attacker must be an authenticated user of the Penpot instance (PR:L — privileges required, low).
• The attacker must obtain another user's upload-session UUID that is live and completed (i.e., all chunks have been uploaded and the session awaits assembly). This is the step that raises attack complexity to High (AC:H), since the session identifier is not directly returned to other users and must be acquired through an out-of-band means or a separate weakness.
• No user interaction from the victim is required (UI:N).

The impact on confidentiality is High because the victim's actual uploaded bytes (potentially sensitive design source files, proprietary fonts, or project imports) are disclosed into an attacker-controlled artifact. Integrity is rated None per the vector — the attacker does not modify the victim's existing stored design objects through this flaw, but instead captures the incoming data into their own container. Availability is Low, reflecting the deletion of the victim's pending upload session, which disrupts that in-progress upload but does not take down the platform.

The scope is unchanged (S:U), meaning the security authority of the vulnerable component is not considered to cross a trust boundary beyond its own authorization model; the flaw remains within the Penpot application's own user-to-user isolation.

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The mechanism described here is derived strictly from the NVD description. No specific function signatures, route paths, parameter names, or database schemas beyond the operations named in the advisory (assemble-chunks, upload-chunk, and the concept of a "session ID") should be assumed; insufficient technical detail is available to characterize the exact storage or transport of the session UUID.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (CWE-862 missing authorization / object-level authorization failure) and the specific asymmetry described between assemble-chunks and upload-chunk. No public exploit exists, so the sequence below describes the class-level mechanism rather than a validated payload.

1. Reconnaissance / target identification. The attacker first confirms the target runs a vulnerable Penpot release (< 2.18.0). Penpot deployments are frequently self-hosted and may be discoverable via web-facing instances. The attacker requires an authenticated account on the target instance, since exploitation occurs within the authenticated upload workflow.

2. Obtaining a target session UUID. Because assemble-chunks keys only on the session ID, the attacker must acquire a victim's live, completed upload-session UUID. The advisory does not specify the acquisition vector; possible routes in the class of IDOR/authorization bugs include predictable session identifiers, leakage of the session ID through other endpoints or logs, or the victim sharing it inadvertently. The requirement to obtain this identifier is the principal reason the CVSS vector rates attack complexity as High (AC:H). Importantly, this step is a precondition, not part of the vulnerable operation itself.

3. Triggering the flaw. With a valid victim session UUID in hand, the authenticated attacker invokes the assemble-chunks operation referencing that session ID. Unlike upload-chunk, which scopes the lookup to the authenticated profile, assemble-chunks performs the lookup using only the provided session ID. The server therefore assembles the victim's session without confirming that the caller owns it, and directs the assembled result into the attacker's own file, team font, or project import destination.

4. Post-exploitation impact. The victim's uploaded bytes are disclosed into an artifact the attacker controls (confidentiality impact). Concurrently, the victim's pending upload session is deleted as part of assembly, disrupting the victim's in-progress upload (availability impact). The attacker can then access, download, or otherwise use the captured design file, font, or import. No lateral privilege escalation beyond the attacker's existing authenticated role is granted by the flaw itself.

Absent a public PoC, defenders should treat any attempt to invoke the assembly operation against session identifiers not associated with the calling account as suspicious.

Impact Assessment

Business impact centers on unauthorized disclosure of data uploaded to Penpot. Design and prototyping platforms often contain pre-release product designs, proprietary brand assets, and internal project files; leakage of these to another tenant user can cause intellectual-property and confidentiality harm. Because the mechanism targets the assembly stage of chunked uploads, any workflow that routes through the chunked-upload and assembly path — general file uploads, team fonts, and project imports — is potentially in scope, per the advisory.

The CVSS v3.1 subscores inform the blast radius:

• Attack Vector: Network (AV:N) — reachable over the network to the application.
• Attack Complexity: High (AC:H) — exploitation depends on obtaining another user's live, completed session UUID, which is not trivially available.
• Privileges Required: Low (PR:L) — the attacker only needs a standard authenticated account.
• User Interaction: None (UI:N) — the victim need not act during the assembly step.
• Scope: Unchanged (S:U).
• Confidentiality: High (C:H) — disclosure of the victim's uploaded bytes.
• Integrity: None (I:N) — no modification of the victim's stored objects is described.
• Availability: Low (A:L) — the victim's pending session is deleted.

The single-victim nature of each exploitation (each stolen session UUID affects one target upload) limits mass impact, but the attacker can iterate across targets if session identifiers can be harvested at scale. Multi-tenant or shared Penpot deployments are the most exposed; single-user/self-hosted instances have a reduced victim pool.

CISA KEV status is NO, meaning no confirmed in-the-wild exploitation is tracked, and EPSS is not yet scored by FIRST.org — no probability estimate should be assumed.

Detection Guidance

Detection should focus on the assemble-chunks operation being invoked with session identifiers that do not correspond to the authenticated caller. Because the advisory does not disclose concrete route paths or parameter names, the rules below key on the operation name and on generic authorization-failure telemetry patterns; they must be tuned to the actual deployment.

Sigma Rule

title: Penpot assemble-chunks Invoked With Foreign Upload Session (CVE-2026-105695)
id: 7c1f9e2a-1b23-4d55-9a1e-penpot862a1
status: experimental
description: Detects requests to Penpot's assemble-chunks operation that may indicate
  cross-user upload-session assembly exploiting missing authorization (CVE-2026-105695).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105695
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: penpot
detection:
  selection_uri:
    cs-uri-stem|contains:
      - 'assemble-chunks'
      - 'assemble_chunks'
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
  filter_owner:
    # Legitimate assembly where the session belongs to the caller.
    # Tune to your application's ownership field once known.
    session_owner_mismatch: 'false'
  condition: selection_uri and selection_method
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate assembly of a user's own upload session
level: medium
tags:
  - attack.t1213
  - cve.2026.105695

YARA Rule

rule CVE_2026_105695_Penpot_AssembleChunks
{
    meta:
        description = "Detects references to the Penpot assemble-chunks operation associated with CVE-2026-105695 in logs or captured artifacts"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105695"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $op1 = "assemble-chunks" ascii nocase
        $op2 = "assemble_chunks" ascii nocase
        $up  = "upload-chunk" ascii nocase
        $cve = "CVE-2026-105695" ascii nocase

    condition:
        (any of ($op1, $op2) and $up) or $cve
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105695 Penpot assemble-chunks unauthorized upload-session assembly attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"assemble-chunks"; nocase; http.uri; content:"session"; nocase; classtype:attempted-user; reference:cve,2026-105695; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105695; sid:2026105695; rev:1;)

Elastic Detection

sequence by user.id with maxspan=30s
  [ network where http.request.method in ("POST", "PUT") and
      http.request.path : "*assemble-chunks*" ]
  [ network where http.request.method in ("POST", "PUT") and
      http.request.path : "*assemble-chunks*" and
      http.response.status_code >= 400 ]

Splunk SPL Query

index=web sourcetype=penpot_access OR sourcetype=nginx
| search uri_path="*assemble-chunks*" (http_method="POST" OR http_method="PUT")
| eval is_targetop = if(match(uri_path, "(?i)assemble[-_]chunks"), 1, 0)
| where is_targetop=1
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as source_ips
        values(user) as users
        values(status) as http_status
        by uri_path, uri_query
| where count >= 1
| table first_seen last_seen uri_path uri_query users source_ips http_status count

Wazuh OSSEC Rule

<group name="penpot,web,cve-2026-105695,">
  <rule id="2026105" level="7">
    <if_sid>31100</if_sid>
    <match>assemble-chunks|assemble_chunks</match>
    <description>CVE-2026-105695: Possible Penpot assemble-chunks cross-user upload-session assembly (missing authorization) attempt</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_105695,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Upgrade to Penpot 2.18.0 or later, which the advisory states fixes the issue (see below). Until patch verification is available, treat this as the primary remediation.
• If immediate upgrade is not possible, restrict access to the Penpot instance to trusted, authenticated users only, reducing the attacker pool able to reach the upload workflow.
• Monitor and alert on assemble-chunks invocations where the referenced session does not belong to the calling account (see Detection Guidance).
• Limit lateral visibility of upload-session identifiers by auditing any endpoint, log, or UI surface that may expose session UUIDs to other users.

2. Patch / upgrade steps

• The NVD description states the issue is fixed in version 2.18.0. Plan an upgrade to 2.18.0 or later and verify the deployed version post-upgrade.
• Validate that the deployed assemble-chunks operation enforces ownership scoping equivalent to upload-chunk (i.e., session lookup restricted to the authenticated profile) after upgrading.
• Because no patch evidence is present in tracked sources, independently confirm the fix through the vendor's official release notes before relying on the upgrade as complete remediation.

3. Long-term hardening

• Enforce consistent object-level authorization across all endpoints of a workflow, not just the entry endpoint; the root cause here is a sibling endpoint (assemble-chunks) lacking the check present in upload-chunk.
• Adopt centralized authorization checks (e.g., a shared ownership-validation layer) so chunked-upload operations cannot diverge in their access-control behavior.
• Strengthen session-identifier handling: avoid exposing session UUIDs to unauthorized parties and consider binding upload sessions to the owning profile at creation.
• Add automated regression tests that assert cross-user access to upload-session assembly is denied.

References

• NVD — CVE-2026-105695: https://nvd.nist.gov/vuln/detail/CVE-2026-105695
• Penpot project (open-source design and prototyping platform) — official release/security information for version 2.18.0
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-105695 is NOT listed; no KEV entry)

No public proof-of-concept, exploit code, Nuclei template, or evidence of in-the-wild exploitation was identified for CVE-2026-105695 at the time of reporting. EPSS has not yet been scored by FIRST.org, so no exploitation-probability estimate is asserted.