{"id":"CVE-2026-97373","title":"draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts","summary":"draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not rej…","severity":"medium","cvss":5.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"jgraph","product":"drawio","affected":["drawio < 30.3.8"],"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T20:52:51.964Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97373","references":[{"url":"https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q","label":"https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q"},{"url":"https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d","label":"https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.573Z","epss":0.00244,"epssPercentile":0.15713,"slug":"CVE-2026-97373","body":"## Overview\n\ndraw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.\n\n## Affected\n\n- `drawio < 30.3.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}