Technical impact
Penpot is an open‑source design and code collaboration platform. Before version 2.15.0, its remote image import feature let a user‑controlled URL from frontend/src/app/main/data/workspace/media.cljs be passed to the backend RPC :create‑file‑media‑object‑from‑url defined in backend/src/app/rpc/commands/media.clj. The backend's media/download‑image routine in backend/src/app/media.clj used a shared HTTP client without destination filtering, allowing an authenticated file editor to retrieve content from internal‑only endpoints. This enabled internal network enumeration by fetching data from services that should remain inaccessible from the public Internet. The vulnerability was resolved in release 2.15.0.
Affected Systems
The open‑source design platform Penpot, any installation running a version prior to 2.15.0. The issue was resolved in release 2.15.0, so installations of that version or newer are not affected.
Risk and Exploitability
The CVSS score of 7.7 categorises this vulnerability as high severity. The EPSS score indicates a probability of exploitation less than 1%, and it is not listed in the CISA KEV catalog. The attack requires an authenticated file‑editor account, no special network access beyond the normal Penpot deployment, and the ability to specify an arbitrary URL for image import. Once executed, the attacker can read internal services that should be isolated from the Internet.
