CVE-2026-63373
MediumCVSS 4.2Summary
draw.io prior to version 30.2.7 skips comparison of stateToken and cookieToken in the OAuth callback handler whenever IS_GAE is false, affecting self-hosted Docker and WAR deployments. An attacker can provide an authorization code for the attacker's cloud-storage identity and induce a victim to visit a callback URL, causing the victim's session to become authenticated as the attacker identity.
Risk Assessment
The victim can unknowingly perform cloud-storage actions under the attacker's identity, causing session integrity loss and misattribution. The identity binding does not itself grant access to existing victim cloud files.
Recommendation
Update draw.io to version 30.2.7 or later, which fixes the OAuth callback handling. Consider reviewing the configuration of Google Drive, OneDrive, GitHub, GitLab, and Dropbox integrations.
Other vulnerabilities in draw.io
See all- CVE-2026-76898High
In draw.io prior to 30.3.8, Utils.sanitizeUrl() checks IPv6 Unique Local Addresses by comparing text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated request to /embed2.js?fetch= can make the server fetch an IPv6 ULA internal resource and reflect the response to the requester.
- CVE-2026-63416Low
draw.io prior to version 30.2.7 uses request.getPathInfo() in ExportProxyServlet.java to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or confirming that the normalized destination remains under the configured export path. An unauthenticated request containing traversal segments can address unintended routes on the internal export server, and the servlet forwards all request headers and the request body, allowing arbitrary header injection.
- CVE-2026-63334Medium
draw.io prior to version 30.2.7 in deployments with ENABLE_DRAWIO_PROXY=1 is vulnerable to server-side request forgery because the private-address check in Utils.sanitizeUrl() uses one DNS resolution, while ProxyServlet.java later calls URL.openConnection() and performs a second resolution. An attacker-controlled hostname can resolve to a public address during validation and then to a private, link-local, or cloud metadata address when the connection is opened.
- CVE-2026-58504Medium
draw.io prior to version 30.2.5 allows execution of attacker-controlled JavaScript in the draw.io origin when a crafted .drawio file is opened or imported. The vulnerability lacks HTML encoding in certain labels, bypassing the previous CVE-2026-46642 fix. An attacker can compromise diagram data, non-HttpOnly cookies, and perform same-origin actions on the victim's behalf.
- CVE-2026-46642Medium
The draw.io application prior to version 29.7.12 contains a vulnerability that allows arbitrary JavaScript execution through a crafted .drawio file. The issue lies in the Text Format panel where the raw cell label is assigned to an element without proper sanitization.
Original NVD description (English source)
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is false, which affects self-hosted Docker and WAR deployments. An attacker can provide an authorization code for the attacker's cloud-storage identity and induce a victim to visit a callback URL, causing the victim's draw.io session to become authenticated as the attacker identity without a valid state binding. The shared handler affects Google Drive, OneDrive, GitHub, GitLab, and Dropbox integrations. The victim can then unknowingly perform cloud-storage actions under the attacker's identity, causing session integrity loss and misattribution, but the identity binding does not itself grant access to existing victim cloud files. This issue is fixed in version 30.2.7.