CVE-2026-105696

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0

Description An issue exists where the get-page RPC (Remote Procedure Call) accepts a share-link permission object providing broad read access but fails to verify if the requested page-id is among the pages authorized by the link. An authenticated attacker possessing a valid share link can retrieve the full shape and design data of other pages within the same file if the page identifier is known. Additionally, the get-file-fragment RPC allows share-link access without properly mapping fragments to authorized pages.

Recommendations Update to version 2.18.0.