CVE-2026-45806

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.15.0

Description An authenticated file editor can reach internal-only endpoints through the remote image import feature. The application passes a user-controlled url from the frontend to the backend RPC method :create-file-media-object-from-url, which then uses the media/download-image function. Because the shared HTTP client lacks destination filtering, it allows for Server-Side Request Forgery (SSRF), a condition where the server is tricked into making requests to an unintended location.

Recommendations Update to version 2.15.0.