CVE-2026-105689

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0

Description An issue exists in the app.util.ssrf/blocked-address? endpoint where Java InetAddress predicates fail to classify NAT64, 6to4, or Teredo addresses and only apply CIDR checks to IPv4 values. This allows a user controlling a media import URL or an administrator controlling a webhook URL to use an IPv6 transition address to embed cloud-metadata, loopback, link-local, or private IPv4 targets, bypassing Server-Side Request Forgery (SSRF) restrictions. SSRF is a vulnerability where an attacker can force a server to make requests to an unintended location. In this case, media imports can disclose response bodies, and webhook delivery can be used as a network-probing side channel to expose response statuses. Exploitation requires routing through a NAT64 gateway or an attacker-controlled DNS AAAA record, making cloud environments with NAT64 gateways directly exploitable.

Recommendations Update to version 2.18.0.