Vulnerability · Published Nov 4, 2026 · Assigned by GitHub_M

CVE-2026-97373draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts

Medium 5.8

In plain English

A medium-severity server-side request forgery in drawio from jgraph. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.2%top 84.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.

Affected products (as reported)

Vendor	Product	Versions
jgraph	drawio	< 30.3.8

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References

https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q x_refsource_CONFIRM
https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d x_refsource_MISC