CVE-2026-105686

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105686
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105686.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105686
Aliases
  • GHSA-qvq5-c536-pmx8
Published
2026-10-05T19:47:56Z
Modified
2026-10-08T02:50:00Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Penpot: Repeated chunk index causes temporary-storage amplification
Details

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing each successful request to allocate another temporary object and increasing stored bytes beyond the upload session's declared logical size. Assembly detects the inconsistent chunk count only after allocation. This issue is fixed in version 2.18.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105686.json"
}
References

Affected packages

Git / github.com/penpot/penpot

Affected ranges

Type
GIT
Repo
https://github.com/penpot/penpot
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
06239844b10b123b7757969ab7618b201d3aba3b
Fixed
5baffdc213f0deaaeb318e97a41d611ac0656a94
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.18.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.0.0
0.1.0
1.*
1.0.0-alpha
1.1.0-alpha
1.14.0-beta
1.14.1-beta
1.2.0-alpha
1.3.0-alpha
1.4.0-alpha
1.4.0-dev
1.4.1-alpha
1.5.0-alpha
1.5.1-alpha
1.5.2-alpha
1.5.3-alpha
1.5.4-alpha
1.6.0-alpha
1.6.1-alpha
1.6.2-alpha
1.6.3-alpha
1.6.4-alpha
1.6.5-alpha
1.7.0-alpha
1.7.1-alpha
1.7.2-alpha
1.7.3-alpha
1.7.4-alpha
1.8.0-alpha
1.8.1-alpha
1.8.2-alpha
1.9.0-alpha
2.*
2.10.0-RC1
2.14.0-RC1
2.14.0-RC2
2.14.0-RC3
2.14.0-RC4
2.15.0-RC1
2.16.0
2.16.0-RC1
2.16.0-RC11
2.16.0-RC13
2.16.0-RC2
2.16.0-RC3
2.16.0-RC4
2.16.0-RC5
2.16.0-RC6
2.16.0-RC7
2.16.0-RC8
2.16.0-RC9
2.16.1-RC2
2.17.0
2.17.0-RC1
2.17.0-RC3
2.17.0-RC4
2.17.0-RC5
2.17.0-RC6
2.17.1-RC1
2.17.1-RC2
2.17.1-RC3
2.17.1-RC4
2.17.1-RC5
2.18.0-RC1
2.18.0-RC2
2.18.0-RC3
2.18.0-RC4
2.5.0-DEV
2.5.0-RC1
2.6.0-RC1
2.7.0-RC1
Other
pre-lazy-loading

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105686.json"