Penpot 2.18.3 fixes SVG import and removed-member access

Open-source design tool Penpot published three patch releases in six days: 2.18.1 on October 1, 2.18.2 on October 5 and 2.18.3 on October 6, 2026. Two of the fixes touch security and access, so self-hosting teams should update.

What changed

• 2.18.3: a binfile import could store SVG content without sanitizing it, and it lacked content types for obfuscated SVGs.
• 2.18.3: team members who were removed could keep access to files after leaving a team.
• 2.18.2: the SVG sanitizer let namespace-prefixed script elements through on upload, and an internal error when syncing components or using the color picker's drag feature was fixed.
• 2.18.1: a workspace freeze caused by a stack overflow when opening the context menu on a shape not on the current page was fixed. Repeated error toasts from third-party scripts were also stopped.

Why it matters

Design files travel between freelancers, agencies and clients, and SVGs are a classic way to smuggle script into a page. A tool that accepts uploads has to treat every file as untrusted. The removed-member bug is just as relevant for agencies: people leave projects all the time, and access should leave with them.

What to do now

• Self-hosting Penpot? Upgrade to 2.18.3.
• Audit your team lists and confirm former collaborators no longer see shared files.

More tools are collected on the Design & Creative hub.

Sources

• Penpot on GitHub: 2.18.3 release notes
• Penpot on GitHub: all releases