CVE-2026-97373: falha de média gravidade em jgraph drawio
draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.8epss 0.2%
draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Produtos afetados
jgraph · drawioCVEs relacionadas — jgraph drawio
No mesmo produto, das mais perigosas para as menos.
CVE-2026-76898HIGHdraw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.jsEPSS 0.4%CVE-2026-63416LOWdraw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpointsEPSS 0.3%CVE-2026-63334MEDIUMdraw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklistEPSS 0.3%CVE-2026-58504MEDIUMdraw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642EPSS 0.3%CVE-2026-46642MEDIUMdraw.io: XSS via crafted cell label when opening a .drawio fileEPSS 0.2%CVE-2026-42195LOWUnvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled hostEPSS 0.2%