CVE-2026-17613

The vulnerability in Penpot's ::import-binfile RPC command allows any authenticated user to exploit the lack of authorization on the optional file-id parameter, leading to unauthorized file overwrites on the server. This could result in full data exfiltration and data poisoning through WebSocket event subscriptions. Organizations using Penpot should prioritize this issue to mitigate the risk of data compromise and integrity loss.