CVE-2026-63416

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.2.7

Description The ExportProxyServlet.java component uses request.getPathInfo() to construct a proxyPath which is appended to the EXPORT URL. Because the application fails to reject dot segments or verify that the normalized destination remains within the configured export path, unauthenticated requests containing traversal segments can access unintended routes on the internal export server. Additionally, the servlet forwards all request headers and the request body to the destination, enabling arbitrary header injection. This may expose administration, debugging, health, or configuration endpoints and allow unauthorized internal actions.

Recommendations Update to version 30.2.7.