An authenticated user with file‑edit permission can upload an SVG file that contains script elements, event‑handler attributes, or foreignObject elements. These uploads are stored exactly as received and then served with the image/svg+xml MIME type from the same domain. When a victim later accesses the asset URL, the browser executes the embedded JavaScript in that origin. Consequently, the attacker can run code with the victim’s session authority, enabling data theft, content injection, or further exploitation within the same Penpot instance.

All installations of Penpot older than version 2.18.0 are vulnerable. The versioning follows the release channel marked as 2.x. Any user with file‑edit rights who uploads SVG media is at risk. Newer versions from 2.18.0 onward are not affected.

The CVSS score of 5.4 places this vulnerability at moderate severity. Because the exploitation requires authentication and file‑edit privileges, the attack surface is limited to users who have been granted those rights. EPSS data is unavailable, and the issue is not listed in CISA’s KEV catalog, suggesting that widespread automated exploitation has not been observed yet. Despite the moderate score, the stored nature of the flaw means that a single compromised asset can be reused by any member who later accesses it.