The vulnerability lies in the chunked media upload RPC of Penpot, where the system validates that a chunk index falls within range but does not reject an index that has already been stored. An authenticated user can repeatedly upload the same valid chunk index during a session, and each successful request creates a new temporary object, increasing the stored bytes beyond the session’s declared logical size. This temporary‑storage amplification can lead to disk exhaustion or degraded performance, effectively causing denial of service. The weakness is classified as CWE‑770.

The affected product is Penpot, the open‑source design and prototyping platform maintained by the Penpot project. Any installation running a version older than 2.18.0 is susceptible. Version 2.18.0 and later include the fix that rejects duplicate chunk indices and prevents extra allocation of temporary objects.

The CVSS score of 5.3 places this vulnerability in the medium severity range. Exploitation requires an authenticated user, limiting the attack to those with valid or compromised credentials. The issue is not listed in CISA’s KEV catalog, indicating no confirmed wild exploitation. The risk remains moderate when storage is provisioned adequately, but a single malicious account can quickly create noticeable strain on the system’s storage, leading to availability degradation.