[HIGH] CVE-2026-26202 — CVSS 7.5

A HIGH-severity vulnerability identified as CVE-2026-26202 has been published on February 19, 2026 with a CVSS base score of 7.5. The vulnerability affects Kaleidos Penpot. This security advisory provides a detailed breakdown of the vulnerability, its potential impact, weakness classification, and actionable steps to protect your systems.

Vulnerability Details

CVE ID: CVE-2026-26202
Severity: HIGH
CVSS Score: 7.5
Published: February 19, 2026
Affected Product: Kaleidos Penpot
Weakness (CWE): CWE-22

Technical Description

Penpot is an open-source design tool for design and code collaboration. Prior to version 2.13.2, an authenticated user can read arbitrary files from the server by supplying a local file path (e.g. `/etc/passwd`) as a font data chunk in the `create-font-variant` RPC endpoint, resulting in the file contents being stored and retrievable as a "font" asset. This is an arbitrary file read vulnerability. Any authenticated user with team edit permissions can read arbitrary files accessible to the Penpot backend process on the host filesystem. This can lead to exposure of sensitive system files, application secrets, database credentials, and private keys, potentially enabling further compromise of the server. In containerized deployments, the blast radius may be limited to the container filesystem, but environment variables, mounted secrets, and application configuration are still at risk. Version 2.13.2 contains a patch for the issue.

Potential Impact

If exploited, this high-severity vulnerability could allow an attacker to compromise sensitive data confidentiality. Organizations running Kaleidos Penpot should treat this as a priority remediation item.

Recommended Action

A patch or vendor advisory is available. Take the following steps immediately:

1. Review the vendor advisory linked in the References section below.
2. Identify all instances of the affected software in your environment.
3. Apply the available patch or upgrade to the fixed version as soon as possible.
4. If patching is not immediately possible, implement compensating controls such as WAF rules, network segmentation, or disabling the affected feature.
5. Monitor your systems for signs of exploitation using your SIEM or IDS/IPS.

View full details on NVD →

References

• Patch
• Exploit, Third Party Advisory

Related Security Advisories

• [HIGH] CVE-2026-27464 — CVSS 7.7 (February 21, 2026) — HIGH / CVSS 7.7
• [HIGH] CVE-2026-27466 — CVSS 7.2 (February 21, 2026) — HIGH / CVSS 7.2
• [HIGH] CVE-2026-26050 — CVSS 7.8 (February 20, 2026) — HIGH / CVSS 7.8