CVE-2026-105689 | Penpot up to 2.17.x SSRF Blocked Address Logic server-side request forgery

October 5, 2026 Yanac

A vulnerability, which was classified as critical, was found in Penpot up to 2.17.x. This affects an unknown part of the component SSRF Blocked Address Logic. Executing a manipulation can lead to server-side request forgery.

This vulnerability is registered as CVE-2026-105689. It is possible to launch the attack remotely. No exploit is available.

You should upgrade the affected component.VulDB Recent EntriesRead More