Arbitrary Local File Disclosure in draw.io Desktop by JGraph

CVE-2026-114606

What is CVE-2026-114606?

The draw.io Desktop application, built on the Electron framework, is susceptible to arbitrary local file disclosure prior to version 31.4.4. This vulnerability arises from the insecure handling of file access in its IPC (Inter-Process Communication) mechanisms, allowing a malicious actor to exploit the read-side handlers without appropriate authorization checks. While write-side actions benefit from protective measures to ensure file security, the reading mechanisms fail to implement analogous restrictions, creating a risk where any frame within the application's file:// origin can access local file contents that should remain off-limits. Users are urged to upgrade to version 31.4.4 or later to mitigate this potential threat.

References