CVE-2026-45806 Details
Description
Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from-url in backend/src/app/rpc/commands/media.clj, where media/download-image in backend/src/app/media.clj used the shared HTTP client without destination filtering, allowing an authenticated file editor to reach internal-only endpoints. This issue is fixed in version 2.15.0.
A server-side request forgery (SSRF) vulnerability has been identified in Penpot, an open-source design tool, prior to version 2.15.0. The issue arises in the remote image import feature, where user-controlled URLs are sent to the backend without proper destination filtering. This allows authenticated file editors to access internal-only endpoints from the Penpot backend.
Users are advised to update to Penpot version 2.15.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/penpot/penpot/security/advisories/GHSA-35g2-w7f6-8v9h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/penpot/penpot/releases/tag/2.15.0 | [email protected] | Release NotesVendor |
| https://github.com/penpot/penpot/security/advisories/GHSA-35g2-w7f6-8v9h | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Penpot | <= 2.14.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |