Read the docs
TI-2026-79319 Aliases CVE-2026-114606

Arbitrary local file read in draw.io Desktop via IPC handlers

Priority MEDIUM 58CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

draw.io Desktop before 31.4.4 is affected. Its Electron main process read-side IPC handlers accept a renderer-chosen file path without the write-side authorization check, a path traversal flaw (CWE-22). Any frame running in the app's file:// origin can read local files that the same origin is forbidden to write, and user interaction is needed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFile actions operate on a renderer-chosen filesystem path with no blessed-path (assertWritablePath) authorization. The only gates are validateSender — a URL-prefix origin check — plus, for readFile alone, a content "sniff" and a lexical appBaseDir prefix block. The write-side handlers (saveFile, writeFile, saveDraft, deleteFile) are all protected by assertWritablePath; the read side is not. The result is a read/write authorization asymmetry: any frame executing in the app's file:// origin can read the contents of local files that the same origin is explicitly forbidden to write. This issue is fixed in version 31.4.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00356 29th percentileScored 2026-11-07
Fix Fixed drawio-desktop (jgraph): 31.4.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jgraphdrawio-desktopbefore 31.4.431.4.4Patch availableCNA
  • drawio-desktop Vendorjgraph Affected before 31.4.4 Fixed in 31.4.4 Patch available CNA

Remediation

Upgrade draw.io Desktop to version 31.4.4, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA drawio-desktop (jgraph) Fixed in 31.4.4

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-114606
  2. 2026-10-23 Priority changed: MEDIUM → LOW
  3. 2026-10-30 CISA SSVC decision points changed
  4. 2026-10-30 Priority changed: LOW → MEDIUM

References

Other 3

  • TI-2023-03691 OS Command Injection in jgraph/drawio CVSS 3.1CRITICAL 9.8
  • TI-2023-03690 OS Command Injection in jgraph/drawio CVSS 3.1CRITICAL 9.8
  • TI-2026-53724 draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js CVSS 4.0HIGH 7.7
  • TI-2023-03178 Denial of Service in jgraph/drawio CVSS 3.1HIGH 7.5
  • TI-2026-83372 Search path hijacking in draw.io Desktop on Windows CVSS 3.1HIGH 7.8
  • TI-2023-02834 Cross-site Scripting (XSS) - Stored in jgraph/drawio CVSS 3.1MEDIUM 6.1
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences