---
id: CVE-2026-97373
title: >-
  draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`:
  RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to
  internal CGNAT hosts
summary: >-
  draw.io is a configurable diagramming and whiteboarding application. Prior to
  30.3.8, the optional /proxy endpoint contains an incomplete server-side
  request forgery blocklist. When the endpoint is enabled, the URL validator
  does not rej…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: jgraph
product: drawio
affected:
  - drawio < 30.3.8
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T20:52:51.964Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-97373'
references:
  - url: 'https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q'
    label: 'https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q'
  - url: >-
      https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d
    label: >-
      https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.573Z'
epss: 0.00244
epssPercentile: 0.15713
---

## Overview

draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.

## Affected

- `drawio < 30.3.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.