Directory Traversal Vulnerability in draw.io by JGraph

CVE-2026-63416

What is CVE-2026-63416?

draw.io, a versatile diagramming and whiteboarding application, has a security vulnerability that allows unauthorized users to exploit the application through improper handling of requests. In versions before 30.2.7, an unauthenticated attacker can leverage a flaw in the ExportProxyServlet, which constructs a proxy path using unvalidated segments. This leads to potential access to sensitive internal routes and endpoints, enabling risks such as arbitrary header injection. It is vital for users to upgrade to version 30.2.7 or later to mitigate these security risks and protect their data from exposure.

References