CVE-2026-105686

— UNSCOREDpublic exploit available

Published 2026-10-05 · Updated 2026-10-06

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing each successful request to allocate another temporary object and increasing stored bytes beyond the upload session's declared logical size. Assembly detects the inconsistent chunk count only after allocation. This issue is fixed in version 2.18.0.

Weaknesses

CWE-770

Public exploit & PoC references

https://github.com/penpot/penpot/commit/06239844b10b123b7757969ab7618b201d3aba3b
https://github.com/penpot/penpot/releases/tag/2.18.0
https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8
https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8

All references

https://github.com/penpot/penpot/commit/06239844b10b123b7757969ab7618b201d3aba3b
https://github.com/penpot/penpot/releases/tag/2.18.0
https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8
https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2023-54404PoC
MEDIUMCVE-2025-12767
UNSCOREDCVE-2025-8352
MEDIUMCVE-2026-100274
MEDIUMCVE-2026-100350PoC
MEDIUMCVE-2026-100508
MEDIUMCVE-2026-100600PoC
LOWCVE-2026-100649PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.