MEDIUM 5.8 NVD
CVE-2026-97373
draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request fo
draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.
References
- https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d
- https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q
This medium severity vulnerability with a CVSS score of 5.8 was published on 2026-11-04 via NVD.
vulnfeed aggregates 16578 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.