Server-Side Request Forgery in draw.io by jgraph
CVE-2026-97373

5.8MEDIUM

Key Information:

Vendor

Jgraph

Status
Drawio
Vendor
CVE Published:
4 November 2026

What is CVE-2026-97373?

The draw.io application, a diagramming and whiteboarding tool, is susceptible to a server-side request forgery vulnerability due to an incomplete blocklist in the proxy endpoint. This flaw, present in versions prior to 30.3.8, allows unauthenticated attackers to exploit the URL validator, failing to reject requests from the shared address range 100.64.0.0/10. By doing so, an attacker could manipulate the draw.io server into accessing internal services, potentially revealing sensitive information from Carrier-Grade NAT, Kubernetes, cloud, or overlay networks.

Affected Version(s)

drawio < 30.3.8

References

https://github.com/jgraph/drawio/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/jgraph/drawio/commit/73c4a91196246bbdb...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.