The vulnerability is a Remote Server Request Forgery (SSRF) guard bypass in Penpot’s webhook and media import features that allows an attacker to supply an IPv6 transition address to leak internal network resources. The SSRF filtering relies on Java InetAddress predicates that fail to classify NAT64, 6to4, and Teredo addresses, applying CIDR checks only to IPv4. As a result, an attacker who controls a media import URL or an administrator who controls a webhook URL can embed a cloud‑metadata, loopback, link‑local, or private IPv4 target within a transition address, causing Penpot to resolve the address and communicate with the target. This can disclose response bodies or, in the case of webhooks, expose response status as a probing side channel.

This issue affects all Penpot installations running version 2.17.x or earlier. The official fix is included in release 2.18.0. The vulnerability is present in the penpot product, vendor penpot:penpot, across all platforms that support webhooks and media import.

The CVSS score is 6.0, indicating moderate severity. No EPSS score is publicly available, so the current exploitation probability is unclear, but the vulnerability is exploitable in cloud environments that use NAT64 gateways or where attackers can control AAAA records. The vulnerability is not listed in the CISA KEV catalog, and no specific workaround is published. Based on the description, the likely attack vector involves injecting a crafted transition address into a media import or webhook URL from an external network, allowing internal network probing or data exfiltration.