CVE-2026-115762

draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses.

In draw.io prior to 30.3.8, Utils.sanitizeUrl() checks IPv6 Unique Local Addresses by comparing text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated request to /embed2.js?fetch= can make the server fetch an IPv6 ULA internal resource and reflect the response to the requester.

draw.io prior to version 30.2.7 uses request.getPathInfo() in ExportProxyServlet.java to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or confirming that the normalized destination remains under the configured export path. An unauthenticated request containing traversal segments can address unintended routes on the internal export server, and the servlet forwards all request headers and the request body, allowing arbitrary header injection.

draw.io prior to version 30.2.7 skips comparison of stateToken and cookieToken in the OAuth callback handler whenever IS_GAE is false, affecting self-hosted Docker and WAR deployments. An attacker can provide an authorization code for the attacker's cloud-storage identity and induce a victim to visit a callback URL, causing the victim's session to become authenticated as the attacker identity.

draw.io prior to version 30.2.7 in deployments with ENABLE_DRAWIO_PROXY=1 is vulnerable to server-side request forgery because the private-address check in Utils.sanitizeUrl() uses one DNS resolution, while ProxyServlet.java later calls URL.openConnection() and performs a second resolution. An attacker-controlled hostname can resolve to a public address during validation and then to a private, link-local, or cloud metadata address when the connection is opened.

draw.io prior to version 30.2.5 allows execution of attacker-controlled JavaScript in the draw.io origin when a crafted .drawio file is opened or imported. The vulnerability lacks HTML encoding in certain labels, bypassing the previous CVE-2026-46642 fix. An attacker can compromise diagram data, non-HttpOnly cookies, and perform same-origin actions on the victim's behalf.

The draw.io application prior to version 29.7.12 contains a vulnerability that allows arbitrary JavaScript execution through a crafted .drawio file. The issue lies in the Text Format panel where the raw cell label is assigned to an element without proper sanitization.

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com, which can lead to credential phishing and session state token exfiltration. This issue has been patched in version 29.7.9.