Penpot's ::import-binfile RPC command has an authorization bypass vulnerability on the optional file-id parameter. This flaw allows any authenticated user to overwrite arbitrary files on the target server and subscribe to WebSocket events, which can lead to full data exfiltration and data poisoning.