CyberRota Analysis
AI-GeneratedPenpot's remote image import functionality prior to version 2.15.0 is vulnerable, allowing authenticated file editors to exploit the lack of destination filtering in the backend HTTP client. This could enable unauthorized access to internal-only endpoints, potentially leading to data exposure or manipulation. Organizations using Penpot for design and code collaboration should prioritize upgrading to version 2.15.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from-url in backend/src/app/rpc/commands/media.clj, where media/download-image in backend/src/app/media.clj used the shared HTTP client without destination filtering, allowing an authenticated file editor to reach internal-only endpoints. This issue is fixed in version 2.15.0.