CVE-2026-63416
Received Received - Intake

Path Traversal in draw.io Export Proxy

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or confirming that the normalized destination remains under the configured export path. An unauthenticated request containing traversal segments can therefore address unintended routes on the internal export server, and the servlet forwards all request headers and the request body to that destination, allowing arbitrary header injection. Depending on the export service configuration, exploitation can expose administration, debugging, health, or configuration endpoints and can permit unintended internal actions. This issue is fixed in version 30.2.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-63416
EUVD
EUVD-2026-83988

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jgraph draw.io to 30.2.7 (exc)
draw.io draw.io to 30.2.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63416 is a path traversal vulnerability in draw.io's ExportProxyServlet. It allows attackers to access unintended backend endpoints by manipulating URL paths with traversal sequences like '../../'. The servlet forwards all request headers and the body to the target endpoint, increasing the risk of unauthorized access.

Detection Guidance

Check for unusual HTTP requests containing path traversal sequences like '../' or './' in URLs targeting draw.io's export endpoints. Inspect server logs for requests to internal paths such as /admin, /debug, or /health. Use tools like curl to test if traversal sequences are processed by sending crafted URLs to the export proxy endpoint.

Impact Analysis

This vulnerability could expose internal HTTP endpoints such as admin interfaces, debug routes, or health-check endpoints that should not be publicly accessible. Attackers might gain unauthorized access to sensitive data or system functions depending on the export service configuration.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing internal endpoints that may handle sensitive data. If exploited, it might allow unauthorized access to administration, debugging, or health-check endpoints, which could lead to data breaches or unauthorized data exposure. This violates principles of data protection and confidentiality required by these regulations.

Mitigation Strategies

Upgrade draw.io to version 30.2.7 or later immediately. If upgrading is not possible, disable the ExportProxyServlet or restrict access to it via network policies. Ensure the export server is isolated and requires authentication. Monitor network traffic for suspicious requests targeting internal endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63416. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart