Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-63416: draw.io allows internal endpoint access via export proxy
CVE-2026-63416 · published 28 days ago
Summary
The draw.io diagramming tool (versions before 30.2.7) forwards requests to its export server without checking the path, so a specially crafted request can reach other internal URLs. This can let outsiders view or interact with admin, health, or configuration pages on your network. Upgrade to version 30.2.7 or later to stop the unsafe forwarding.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| jgraph | drawio | < 30.2.7 |
Original advisory text
draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or confirming that the normalized destination remains under the configured export path. An unauthenticated request containing traversal segments can therefore address unintended routes on the internal export server, and the servlet forwards all request headers and the request body to that destination, allowing arbitrary header injection. Depending on the export service configuration, exploitation can expose administration, debugging, health, or configuration endpoints and can permit unintended internal actions. This issue is fixed in version 30.2.7.
References
- https://github.com/jgraph/drawio/security/advisories/GHSA-3pq9-9hg4-ggfw
- https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e
- https://github.com/jgraph/drawio/releases/tag/v30.2.7
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63416... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63416 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published21 Sep 2026
Updated19 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta