CVE-2026-114606

Name of the Vulnerable Software and Affected Versions draw.io Desktop versions prior to 31.4.4

Description An arbitrary local-file disclosure exists due to a read/write authorization asymmetry in the Electron main process's read-side IPC handlers. While write-side handlers are protected by assertWritablePath, the read-side actions operate on renderer-chosen filesystem paths without similar authorization. The affected functions include readFile(), getFileDrafts(), getBkpFile(), fileStat(), isFileWritable(), checkFileExists(), and watchFile(). Consequently, any frame executing in the application's file:// origin can read local files that the same origin is forbidden from writing.

Recommendations Update to version 31.4.4.