Do Son 
TL;DR
Maintainers of the open-source design tool Penpot patched a critical Penpot file takeover flaw. The fix arrives as researchers publicly disclosed the full bug details and proof-of-concept (PoC) exploit code. Tracked as GHSA-8qqw-wm58-45v7 (CVSS 9.9), the bug lets any logged-in user overwrite and steal any file on a server. Admins must update to version 2.18.0 right away to block attacks.
Why It Matters
Penpot is a popular open-source web app for UI and UX design teams. Companies use it to build product mockups, brand decks, and shared design libraries. However, the public release of full bug details and PoC exploit code in the GitHub security advisory puts unpatched servers at high risk.
Security researcher Louis Sanchez of Voke Cyber first reported the main bug and a related WebSocket flaw. Later, researcher rbrents3000 independently reported the same file import bug under GHSA-whxm-54w3-qr7w. Although the public report shares a working PoC exploit, no active attacks in the wild have been confirmed yet.
Even so, the impact of a successful attack is severe. The advisory header scores the flaw at 9.9 Critical, while the report text notes a 10.0 score when open sign-ups are on. While exact install counts remain private, thousands of teams run Penpot via Docker and cloud hosts.
How the Attack Works
In-Place Binfile Import Overwrite
First, the Penpot file takeover bug stems from missing auth checks (CWE-862) and user key bypasses (CWE-639) in the Clojure backend. When a user calls the import-binfile RPC route, the server only checks edit rights on the caller’s own project. However, the code never checks who owns the target file-id parameter.
Consequently, when an attacker sends a victim file UUID, the backend enters an in-place overwrite mode. The database query fetches the victim file by its ID alone with no team or project check. Next, the server writes the attacker’s file data straight into the victim’s database row. At the same time, it changes the file’s project-id to the attacker’s own project.
As a result, the victim loses their design work and cannot use the restore tool. Meanwhile, the attacker becomes the new owner and can read, edit, or export the stolen file. Furthermore, if the hijacked file is a shared library, every linked file across other teams pulls in the attacker’s changes on the next sync.
Bundled WebSocket Stream Spying
Second, the publicly disclosed report details a high-risk flaw (CVSS 7.7) in the WebSocket service. Both the subscribe-file and subscribe-team handlers lack access checks on target UUIDs. Therefore, any logged-in user who knows a file or team UUID can watch live edit streams. This bug lets an attacker view live design edits, team role changes, and cursor moves in real time.
Affected Versions
These flaws affect every multi-user Penpot server starting from version 1.20, when devs first added the file-id import feature in July 2025. All self-hosted builds from version 1.20 before version 2.18.0 are open to this cross-team attack.
Patch and Mitigation Steps
The dev team fixed both the Penpot file takeover bug and the WebSocket flaw in version 2.18.0. Specifically, they merged pull request 10994 to drop the unsafe file-id field from the import-binfile schema. They also merged pull request 11069 to add strict access checks to all WebSocket file and team streams.
Because the bug details and PoC exploit code are now public, admins must update to Penpot 2.18.0 right away. Until teams can patch, self-hosted admins should turn off open user sign-ups and limit network access to trusted staff. Finally, teams should check database logs for odd project-id changes across teams.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
