CVE-2026-97373

    Dashboard / Vulnerabilities / CVE-2026-97373

    CVE-2026-97373

    Published: 4 Nov 2026Last Modified: 6 Nov 2026

    Summary: draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts

    Details: draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97373.json, https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q, https://nvd.nist.gov/vuln/detail/CVE-2026-97373, https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -73c4a91196246bbdb60f52b15871e82006b7972d

    Affected versions

    v30.3.6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-97373 | CVE-DB