A vulnerability categorized as critical has been discovered in Penpot up to 2.13.1. This affects an unknown function of the component RPC Endpoint. Such manipulation leads to path traversal.
This vulnerability is referenced as CVE-2026-26202. It is possible to launch the attack remotely. No exploit is available.
It is advisable to upgrade the affected component.
