CVE-2026-63416
LowCVSS 3.7Summary
draw.io prior to version 30.2.7 uses request.getPathInfo() in ExportProxyServlet.java to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or confirming that the normalized destination remains under the configured export path. An unauthenticated request containing traversal segments can address unintended routes on the internal export server, and the servlet forwards all request headers and the request body, allowing arbitrary header injection.
Risk Assessment
Depending on the export service configuration, an attacker can reach administration, debugging, health, or configuration endpoints and trigger unintended internal actions. The vulnerability requires no authentication, increasing the risk.
Recommendation
Upgrade draw.io to version 30.2.7 or later, which fixes this issue. Until then, consider restricting access to the export servlet and segmenting the internal network.
Other vulnerabilities in draw.io
See all- CVE-2026-76898High
In draw.io prior to 30.3.8, Utils.sanitizeUrl() checks IPv6 Unique Local Addresses by comparing text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated request to /embed2.js?fetch= can make the server fetch an IPv6 ULA internal resource and reflect the response to the requester.
- CVE-2026-63373Medium
draw.io prior to version 30.2.7 skips comparison of stateToken and cookieToken in the OAuth callback handler whenever IS_GAE is false, affecting self-hosted Docker and WAR deployments. An attacker can provide an authorization code for the attacker's cloud-storage identity and induce a victim to visit a callback URL, causing the victim's session to become authenticated as the attacker identity.
- CVE-2026-63334Medium
draw.io prior to version 30.2.7 in deployments with ENABLE_DRAWIO_PROXY=1 is vulnerable to server-side request forgery because the private-address check in Utils.sanitizeUrl() uses one DNS resolution, while ProxyServlet.java later calls URL.openConnection() and performs a second resolution. An attacker-controlled hostname can resolve to a public address during validation and then to a private, link-local, or cloud metadata address when the connection is opened.
- CVE-2026-58504Medium
draw.io prior to version 30.2.5 allows execution of attacker-controlled JavaScript in the draw.io origin when a crafted .drawio file is opened or imported. The vulnerability lacks HTML encoding in certain labels, bypassing the previous CVE-2026-46642 fix. An attacker can compromise diagram data, non-HttpOnly cookies, and perform same-origin actions on the victim's behalf.
- CVE-2026-46642Medium
The draw.io application prior to version 29.7.12 contains a vulnerability that allows arbitrary JavaScript execution through a crafted .drawio file. The issue lies in the Text Format panel where the raw cell label is assigned to an element without proper sanitization.
Original NVD description (English source)
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or confirming that the normalized destination remains under the configured export path. An unauthenticated request containing traversal segments can therefore address unintended routes on the internal export server, and the servlet forwards all request headers and the request body to that destination, allowing arbitrary header injection. Depending on the export service configuration, exploitation can expose administration, debugging, health, or configuration endpoints and can permit unintended internal actions. This issue is fixed in version 30.2.7.