Skip to content
OpenAdvisories
Medium WID-SEC-2026-3506 5 CVEs

drawio: Mehrere Schwachstellen

Published Sep 21, 2026 · Updated Sep 21, 2026 · de-DE

Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in drawio ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren oder offenzulegen.

Product

Open Source draw.io ist eine quelloffene Software zur Erstellung von Diagrammen und Flussdiagrammen.

Vulnerabilities 5

  • High 7.7
    CVE-2026-76898

    draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js

    draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK r…

    jgraph drawio
  • Medium 6.8
    CVE-2026-63334

    draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist

    draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address…

    jgraph drawio
  • Medium 6.1
    CVE-2026-58504

    draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642

    draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.add…

    jgraph drawio
  • Medium 4.2
    CVE-2026-63373

    draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection

    draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is false, which affects se…

    jgraph drawio
  • Low 3.7
    CVE-2026-63416

    draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints

    draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot …

    jgraph drawio

Revision history

  1. #1

    Initiale Fassung

References