CVE-2026-97373

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.3.8

Description The optional '/proxy' endpoint contains an incomplete server-side request forgery (SSRF) blocklist. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. When this endpoint is enabled, the URL validator fails to reject the RFC 6598 shared address range 100.64.0.0/10. This allows an unauthenticated remote attacker to force the server to request internal services within that range, which may lead to the disclosure of data from cloud, Kubernetes, overlay-network, or Carrier-Grade NAT addresses.

Recommendations Update to version 30.3.8. As a temporary mitigation, disable the '/proxy' endpoint.