Skip to content
OpenAdvisories

Vendor

jgraph

37 known vulnerabilities.

Products

jgraph/drawio 26 drawio 9 drawio-desktop 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-63416

    draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints

    draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot …

    jgraph drawio
  • Low 3.4
    CVE-2026-42195

    Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host

    draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io…

    jgraph drawio