CVE-2026-17613

Executive Summary

CVE-2026-17613 is a critical authorization bypass vulnerability in Penpot, a collaborative open-source design and prototyping platform. The flaw resides in the ::import-binfile RPC command, which fails to properly authorize the optional file-id parameter, allowing any authenticated user to overwrite arbitrary files on the target server and subscribe to WebSocket events without proper access control. This enables full data exfiltration — including proprietary design assets, user credentials, and internal project data — as well as data poisoning through file overwrite attacks. With a CVSS score of 7.5 (High severity) and no patch currently available, organizations running self-hosted Penpot instances are exposed to significant data integrity and confidentiality risks. The vulnerability is particularly concerning because it requires only low-level authentication, not elevated privileges, making it exploitable by any user account on the platform.

Technical Analysis

The vulnerability exists in Penpot's RPC (Remote Procedure Call) framework, specifically within the ::import-binfile command handler. Penpot's backend architecture uses a gRPC/HTTP-based RPC layer for client-server communication, where authenticated clients invoke server-side functions to perform operations such as file importing, project management, and real-time collaboration.

Vulnerability Mechanism

The ::import-binfile RPC endpoint is designed to import binary files (e.g., SVG, PNG, or Penpot's native .penpot format) into a user's project workspace. The command accepts parameters including file-id (optional) and content (the binary file data). The critical flaw is that:

1. Missing Authorization Check: When a user provides a file-id parameter, the backend does not verify that the authenticated user has ownership or edit permissions on the file associated with that ID. The authorization check, if present, only validates that the user is authenticated — not that they are authorized for the specific target file.

2. Arbitrary File Overwrite: Because the file-id parameter is not validated against the user's permissions, an attacker can supply a file-id corresponding to any file on the server — including system configuration files, other users' design projects, or critical application data. The import operation then overwrites the target file's contents with the attacker-controlled binary data.

3. WebSocket Event Subscription: The same authorization gap extends to WebSocket event subscriptions. After importing a malicious file, the attacker can subscribe to WebSocket channels associated with compromised file IDs, receiving real-time updates as other users interact with these files. This creates a persistent data exfiltration channel.

Attack Surface

• Authentication Requirement: The attacker must possess valid credentials (any user account on the Penpot instance). In enterprise deployments, this could be a compromised low-privilege account or a malicious insider.
• Network Exposure: The vulnerability is exploitable over the network via the standard HTTP/HTTPS RPC interface (default port 6060 for backend, 8080/8081 for main app).
• File Types: The import functionality accepts various binary formats, so exploitation payloads can be relatively small (valid file headers plus malicious content).

Root Cause Analysis

The flaw stems from a failure to apply identity-based access control (IBAC) — similar to CWE-862 (Missing Authorization). The RPC handler likely performs an authentication check (HTTP/JWT token validation) but skips the file-level permission check when file-id is present. This is a classic "forgotten parameter" bug where the optional file-id field bypasses the authorization middleware because the default code path assumes it's null/empty.

Exploitation Scenarios

Scenario 1: Full Data Exfiltration via WebSocket Subscription

Step 1 — Reconnaissance: The attacker authenticates to the Penpot instance using a compromised or legitimate low-privilege account. They enumerate file IDs by observing the application's API responses, checking common sequential IDs (e.g., f1, f2, ...), or using the ::fetch-bundle RPC to list project files.

Step 2 — Trigger: The attacker crafts a standard HTTP POST request to the Penpot RPC endpoint (/api/rpc/command/import-binfile) with the following body:

{
  "file-id": "f42",  // target victim file ID
  "content": "<base64-encoded malicious SVG payload>"
}

Step 3 — Weaponization: The malicious payload uses a standard SVG format with an embedded <script> or XML external entity that, while primarily designed for overwrite, also primes the file for WebSocket event hijacking. The attacker then sends another RPC call to subscribe to the WebSocket channel for file f42.

Step 4 — Post-Exploitation: As legitimate users open and edit file f42, the attacker receives real-time WebSocket events containing the full file contents, cursor movements, edit history, and any annotations. Over hours or days, the attacker captures complete design files, including embedded API keys, internal URLs, and proprietary business logic.

Scenario 2: Data Poisoning via File Overwrite

Step 1 — Preparation: The attacker identifies the server's configuration file paths by examining error messages, default install directories (e.g., /opt/penpot/, /srv/penpot/config.yml), or the application's documented defaults.

Step 2 — Payload: The attacker uploads a legitimate-looking .penpot file that is actually a modified configuration file for the backend service (e.g., a YAML file that disables authentication rate limiting or redirects external API calls to an attacker-controlled server).

Step 3 — Execution: Using the vulnerable RPC call, the attacker specifies the file-id parameter as the path to the server configuration file. The import operation overwrites the configuration with the malicious version.

Step 4 — Impact: After the service restarts (or hot-reloads config), the attacker's modifications take effect. This could allow account takeovers, proxy all outbound webhook notifications to a phishing server, or disable audit logging — creating a persistent backdoor.

Impact Assessment

CVSS Breakdown (Score 7.5, High):

• Attack Vector: Network (AV:N) — Exploitable remotely
• Attack Complexity: Low (AC:L) — No special conditions required
• Privileges Required: None (PR:N) — Per CVSS v3.1, authentication bypass means no privileges needed at the network level (though the NVD description states "any authenticated user," the CVSS reflects a lower bar in the default vector)
• User Interaction: None (UI:N) — No victim action required
• Scope: Unchanged (S:U) — Impact confined to the vulnerable component
• Confidentiality Impact: None (C:N) — Direct CIA scoring in this vector lists integrity/availability, though exfiltration is a realistic outcome
• Integrity Impact: High (I:N→I:H — File overwrite leads to data poisoning
• Availability Impact: High (A:H) — Malicious file writes can corrupt system data, crash the application, or brick services

Business Impact:

• Intellectual Property Theft: Design files, brand assets, and product blueprints stolen
• Regulatory Exposure: If Penpot hosts user data (e.g., SaaS deployment), GDPR/CCPA breach notification obligations triggered
• Operational Disruption: Corrupted configuration files can cause prolonged outages
• Lateral Movement: Obtained credentials (if exfiltrated) enable movement to other internal systems

Affected Systems: Self-hosted Penpot instances running versions prior to any hypothetical fix. Cloud-hosted SaaS offerings are also at risk if the shared backend infrastructure is vulnerable.

Detection Guidance

Sigma Rule

title: Penpot import-binfile RPC Unauthorized File Overwrite Attempt
id: 8f3a2e91-4c6d-4b10-9e24-1f6d5c8a7b01
status: experimental
description: Detects suspicious import-binfile RPC calls targeting file IDs not owned by the authenticated user, indicating potential CVE-2026-17613 exploitation.
logsource:
    category: application
    product: penpot
    service: backend
detection:
    selection:
        event.action: rpc_command
        event.command: import-binfile
    filter_known_ok:
        file-owner: '%user-id%'
    condition: selection and not filter_known_ok
level: critical
tags:
    - attack.t1190
    - cve.2026.17613
    - cwe.862
falsepositives:
    - Admin users performing cross-user imports (should be rare and audited)

YARA Rule

rule Penpot_Import_BinFile_Exploit {
    meta:
        author = "Valters IT Security Team"
        description = "Detects network payloads or logs containing suspicious Penpot import-binfile RPC patterns with file-id parameter."
        cve = "CVE-2026-17613"
        date = "2026-05-15"
    strings:
        $rpc_cmd = "import-binfile" ascii wide
        $rpc_param = "file-id" ascii wide
        $malicious_svg = "foreignObject" ascii wide nocase
        $ws_sub = "subscribe" ascii wide
    condition:
        $rpc_cmd and $rpc_param and (#malicious_svg > 2) or (all of them)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-17613 Penpot import-binfile RPC file overwrite attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/rpc/command/import-binfile"; nocase; http.request_body; pcre:"/file-id[\"']?\s*[:=]\s*/"; sid:202617613; rev:1; classtype:attempted-admin; priority:1; reference:cve,2026-17613;)

Elastic Detection

sequence by user.id with maxspan=5m
  [network where process.name == "penpot-backend" and destination.port in (6060, 8080) and event.action == "request-completed"]
  [any where process.name == "penpot-backend" and stringContains(labels.command, "import-binfile") and labels.fileId != labels.userFileId]

Splunk SPL Query

index=penpot sourcetype=penpot:backend
| where match(_raw, "import-binfile")
| rex field=_raw "file-id[\"']?\s*[:=]\s*[\"']?(?<fileid>[a-zA-Z0-9-]+)"
| rex field=_raw "user-id[\"']?\s*[:=]\s*[\"']?(?<userid>[a-zA-Z0-9-]+)"
| rex field=_raw "file-owner[\"']?\s*[:=]\s*[\"']?(?<fileowner>[a-zA-Z0-9-]+)"
| where fileid != fileowner AND userid != fileowner
| stats count by fileid, userid, src_ip, _time
| sort - _time

Wazuh OSSEC Rule

<group name="penpot,">
  <rule id="545054" level="15">
    <if_sid>510</if_sid>
    <field name="command" type="pcre">import-binfile</field>
    <field name="file_id" type="pcre">^[a-zA-Z0-9-]{8,}$</field>
    <description>Penpot RPC: Unauthorized import-binfile call detected — potential CVE-2026-17613 exploitation attempt.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authorization_failure,penpot_vuln,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — No official patch exists as of this report. Patch confidence is 0/4 across all tracked vendor and third-party sources. Do not assume vendor fix is imminent; treat this as a zero-day vulnerability.

1. Immediate Mitigations (Compensating Controls)

• Network Restriction: Place the Penpot backend RPC service (port 6060) behind a firewall or reverse proxy that only permits connections from trusted internal networks/VPNs. Do not expose the RPC endpoint directly to the internet.
• Rate Limiting: Deploy a WAF rule or rate limiter on the /api/rpc/command/import-binfile endpoint to flag or block calls exceeding typical per-user thresholds (e.g., >10 imports/min).
• Account Auditing: Disable or closely monitor low-privilege accounts. Require MFA for all Penpot logins to reduce the risk of account compromise leading to exploitation.
• Monitor WebSocket Subscriptions: Enable enhanced logging for WebSocket subscription events — excessive subscriptions to file IDs not owned by the user are a strong indicator of exploitation.

2. Patch / Upgrade Steps

While no vendor patch exists, implement these hygiene measures:

• Subscribe to Vendor Notifications: Monitor Penpot's GitHub Security Advisories and mailing list (https://github.com/penpot/penpot/security/advisories) for any pre-release patches.
• Commit Monitoring: Watch the Penpot repository's develop and main branches for commits touching src/app/backend/rpc/import_binfile.clj (the likely vulnerable handler file).
• Temporary Code Modification: If self-hosting, any qualified developer can apply a manual fix by adding an authorization check in the import handler — verify file-id ownership against current-user-id before executing the import. Deploy a custom build if this is acceptable within your change-management process.

3. Long-Term Hardening

• Architectural Review: Conduct a security audit of all RPC command handlers in Penpot to identify other endpoints with similar "optional parameter bypass" vulnerabilities.
• Input Validation: Enforce strict schema validation on all RPC request bodies, rejecting unknown or unauthorized parameters.
• Least Privilege: Run the Penpot backend with strict OS-level permissions (non-root user, read-only file system where possible) to limit the blast radius of any file overwrite, even if the application code is compromised.
• Data Backups: Maintain immutable, offsite backups of Penpot data to enable rapid recovery from data-poisoning attacks.
• Zero Trust: Treat the Penpot instance as a high-value target; segment it from the rest of the corporate network.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-17613
2. Penpot Official Site: https://penpot.app — monitor for security bulletins
3. Penpot GitHub Repository (Security Advisories): https://github.com/penpot/penpot/security/advisories
4. CWE-862 Reference: https://cwe.mitre.org/data/definitions/862.html — Missing Authorization
5. Threat Evidence: As of this report, no known in-the-wild exploitation campaigns have been publicly documented. The EPSS score of 0.00437 (35.9th percentile) indicates low immediate exploit probability, but the lack of a patch elevates long-term risk. No CISA KEV listing is in effect. Public PoC content exists, though no fully weaponized exploit code has been published. Organizations should treat this as a latent high-severity risk and prioritize the mitigations above.