CVE-2026-97373
draw.io is a configurable diagramming and whiteboarding application.
Impact
draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.
An attacker can exploit this over the network, without logging in, without any action by a user. If it succeeds: low risk of data being read. The attack can reach beyond the vulnerable component itself.
Affected products · Jgraph
| Product | Affected versions |
|---|---|
| Drawio | before 30.3.8 Version < 30.3.8 |