{"id":"CVE-2026-17613","aliases":["EUVD-2026-53386","GHSA-7ff3-w2cq-gmpq"],"status":"published","title":"CVE-2026-17613","description":"Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00613,"percentile":0.49806,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-08-05T14:12:03Z","modified":"2026-09-03T17:45:20Z","products":[{"vendor":"penpot","product":"penpot"}],"references":[{"url":"https://penpot.app/","tags":["web"]},{"url":"https://vokecyber.com/blog/cve-2026-17613-penpot-cross-team-file-takeover","tags":["article"]},{"url":"https://vokecyber.com/research/cve-2026-17613-penpot-cross-team-file-takeover","tags":["exploit","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17613","tags":["advisory"]},{"url":"https://github.com/penpot/penpot/releases/tag/2.17.0","tags":["web"]},{"url":"https://penpot.app"},{"url":"https://github.com/advisories/GHSA-7ff3-w2cq-gmpq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17613.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-17613","title":"CVE-2026-17613","description":"Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.","status":"published","published":"2026-08-05T14:12:03.942Z","modified":"2026-08-27T11:41:04.192Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:54.84674Z"}],"euvd":[{"id":"EUVD-2026-53386","description":"Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.","status":"published","published":"2026-08-05T14:12:03Z","modified":"2026-08-27T11:41:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:28.581047Z"}],"ghsa":[{"id":"GHSA-7ff3-w2cq-gmpq","title":"Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter,...","description":"Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.","status":"published","published":"2026-08-05T15:32:22Z","modified":"2026-08-05T18:31:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:10:07.328501Z"}],"nvd":[{"id":"CVE-2026-17613","description":"Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.","status":"published","published":"2026-08-05T15:16:40.003Z","modified":"2026-09-03T17:45:20.84Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"CVE-2026-17613","title":"CVE-2026-17613","description":"Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.","status":"published","published":"2026-08-05T14:12:03.942Z","modified":"2026-08-14T04:03:42.729816643Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:58.024074Z"}]}}