Read the docs
TI-2026-85183 Aliases CVE-2026-97373

Incomplete SSRF blocklist in draw.io proxy allows requests to CGNAT range

Priority LOW 26CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

draw.io before 30.3.8 has an incomplete server-side request forgery blocklist in its optional /proxy endpoint when that endpoint is enabled. The URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10 (CWE-918). An unauthenticated remote attacker can make the draw.io server request internal services reachable in that range, potentially disclosing data from those hosts.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.

Why it matters now

EPSS 0.00244 15th percentileScored 2026-11-07
Fix Fixed drawio (jgraph): 30.3.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
jgraphdrawiobefore 30.3.830.3.8Patch availableCNA
  • drawio Vendorjgraph Affected before 30.3.8 Fixed in 30.3.8 Patch available CNA

Remediation

Update jgraph drawio to version 30.3.8, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA drawio (jgraph) Fixed in 30.3.8

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-97373
  2. 2026-11-06 Priority changed: MEDIUM → LOW

References

Other 2

  • TI-2023-03691 OS Command Injection in jgraph/drawio CVSS 3.1CRITICAL 9.8
  • TI-2023-03690 OS Command Injection in jgraph/drawio CVSS 3.1CRITICAL 9.8
  • TI-2026-53724 draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js CVSS 4.0HIGH 7.7
  • TI-2023-03178 Denial of Service in jgraph/drawio CVSS 3.1HIGH 7.5
  • TI-2026-83372 Search path hijacking in draw.io Desktop on Windows CVSS 3.1HIGH 7.8
  • TI-2023-02834 Cross-site Scripting (XSS) - Stored in jgraph/drawio CVSS 3.1MEDIUM 6.1
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences