PT-2026-20920 · Penpot · Penpot

Alimaharramli · Published 2026-02-19 · Updated 2026-02-23 · CVE-2026-26202

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.13.2

Description Penpot is an open-source design and code collaboration tool. An authenticated user with team edit permissions can read arbitrary files from the server. This is achieved by providing a local file path, such as /etc/passwd, as a font data chunk in the create-font-variant RPC endpoint. The file contents are then stored and retrievable as a "font" asset. This can expose sensitive system files, application secrets, database credentials, and private keys, potentially leading to further compromise of the server. In containerized deployments, the risk extends to environment variables, mounted secrets, and application configuration. The vulnerable API endpoint is /create-font-variant and the vulnerable variable is the font data chunk.

Recommendations Update to version 2.13.2 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-73

Related Identifiers

CVE-2026-26202

GHSA-XP3F-G8RQ-9PX2

Affected Products

Penpot

References · 6

• 🔥 https://github.com/penpot/penpot/security/advisories/GHSA-xp3f-g8rq-9px2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26202.json · Exploit
• https://github.com/penpot/penpot/commit/06e5825c8a0209889966a4eb5152efd6ff108626 · Patch
• https://osv.dev/vulnerability/CVE-2026-26202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26202 · Security Note
• https://twitter.com/CVEnew/status/2025809094498730005 · Twitter Post