CVE-2026-97373Medium· 5.8▾ Sunlitdraw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not rej…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 31.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.
drawio < 30.3.8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-76898High· 7.7draw.io is a configurable diagramming and whiteboarding application
CVE-2026-63334Medium· 6.8draw.io is a configurable diagramming and whiteboarding application
CVE-2026-115762Medium· 6.1draw.io: Prototype pollution in GraphML (mxGraphMlCodec)
CVE-2026-58504Medium· 6.1draw.io is a configurable diagramming and whiteboarding application
CVE-2026-63416Low· 3.7draw.io is a configurable diagramming and whiteboarding application
CVE-2026-63373Medium· 4.2draw.io is a configurable diagramming and whiteboarding application