CVE-2026-26202: Kaleidos Penpot path traversal (CVSS 7.5)

Description

Penpot is an open-source design tool for design and code collaboration. Prior to version 2.13.2, an authenticated user can read arbitrary files from the server by supplying a local file path (e.g. `/etc/passwd`) as a font data chunk in the `create-font-variant` RPC endpoint, resulting in the file contents being stored and retrievable as a "font" asset. This is an arbitrary file read vulnerability. Any authenticated user with team edit permissions can read arbitrary files accessible to the Penpot backend process on the host filesystem. This can lead to exposure of sensitive system files, application secrets, database credentials, and private keys, potentially enabling further compromise of the server. In containerized deployments, the blast radius may be limited to the container filesystem, but environment variables, mounted secrets, and application configuration are still at risk. Version 2.13.2 contains a patch for the issue.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Kaleidos Penpot< 2.13.2

Remediation

Fixed in

Kaleidos Penpot≥ 2.13.2

Patch & vendor advisories

https://github.com/penpot/penpot/commit/06e5825c8a0209889966a4eb5152efd6ff108626

References

https://github.com/penpot/penpot/commit/06e5825c8a0209889966a4eb5152efd6ff108626Patch
https://github.com/penpot/penpot/security/advisories/GHSA-xp3f-g8rq-9px2ExploitThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-26202 being actively exploited?

CVE-2026-26202 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.57%.

How severe is CVE-2026-26202?

CVE-2026-26202 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 0.57% probability of exploitation.

Which products are affected by CVE-2026-26202?

Affected products include Kaleidos Penpot.

How do I fix CVE-2026-26202?

Upgrade affected software to a fixed version, for example Kaleidos Penpot 2.13.2 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-26202 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo