CVE-2026-105686

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0

Description The chunked media upload RPC validates that a chunk index is in range but fails to reject already stored indices or replace previous objects. An authenticated user can repeatedly upload the same valid index, leading to the allocation of multiple temporary objects for each successful request. This process increases the stored bytes beyond the declared logical size of the upload session. The system only detects the inconsistent chunk count after the allocation has occurred.

Recommendations Update to version 2.18.0.