CVE-2026-26202 Penpot has Arbitrary File Read via create-font-variant RPC endpoint
Authenticated users can read arbitrary server files via the create-font-variant endpoint, exposing secrets and system files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-26202?
CVE-2026-26202 is a high-severity path traversal vulnerability in penpot, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Penpot is an open-source design tool for design and code collaboration. Prior to version 2.13.2, an authenticated user can read arbitrary files from the server by supplying a local file path (e.g. `/etc/passwd`) as a font data chunk in the `create-font-variant` RPC endpoint, resulting in the file contents being stored and retrievable as a "font" asset. This is an arbitrary file read vulnerability. Any authenticated user with team edit permissions can read arbitrary files accessible to the Penpot backend process on the host filesystem. This can lead to exposure of sensitive system files, application secrets, database credentials, and private keys, potentially enabling further compromise of the server. In containerized deployments, the blast radius may be limited to the container filesystem, but environment variables, mounted secrets, and application configuration are still at risk. Version 2.13.2 contains a patch for the issue.
Which versions are affected by CVE-2026-26202?
It affects 1 product.
Products include Kaleidos Penpot.
How do I fix CVE-2026-26202?
No fix has been published for CVE-2026-26202 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-26202 being exploited?
There is no known exploitation of CVE-2026-26202 in the wild and no public exploit code.
Sources
Also known as GHSA-xp3f-g8rq-9px2.