A path traversal vulnerability in Penpot allows authenticated users to read arbitrary files from the server, posing a significant risk of credential and secret exposure.

This is a path traversal and improper file path control issue (CWE-22 and CWE-73). An authenticated user with team edit permissions can manipulate the create-font-variant RPC endpoint to read arbitrary files from the host filesystem by providing a local file path as a font data chunk.

The ability to read arbitrary files, including configuration files, database credentials, and private keys, represents a critical security failure. Successful exploitation could lead to full system compromise or lateral movement within the environment. While the CVSS score is 7.5, the potential for total loss of confidentiality regarding application secrets necessitates urgent remediation.

Immediate Action: Update Penpot to version 2.13.2 or later to include the security patch.

Proactive Monitoring: Monitor access logs for suspicious RPC requests to the create-font-variant endpoint, particularly those containing directory traversal patterns like dot-dot-slash.

Compensating Controls: Implement strict file system permissions for the Penpot process to ensure it can only access required directories, and use a Web Application Firewall to filter requests containing path traversal sequences.

Public Exploit Available: Unknown

Given the ease of exploitation and the severity of the potential data exposure, administrators should prioritize updating to version 2.13.2 immediately. Organizations unable to patch should verify that the Penpot service is running with the principle of least privilege regarding file system access to minimize the impact of a potential breach.