CVE-2026-63416 in draw.io
Summary
by MITRE • 09/21/2026
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or confirming that the normalized destination remains under the configured export path. An unauthenticated request containing traversal segments can therefore address unintended routes on the internal export server, and the servlet forwards all request headers and the request body to that destination, allowing arbitrary header injection. Depending on the export service configuration, exploitation can expose administration, debugging, health, or configuration endpoints and can permit unintended internal actions. This issue is fixed in version 30.2.7.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in draw.io prior to version 30.2.7 represents a critical path traversal and header injection flaw within the ExportProxyServlet component. As a configurable diagramming and whiteboarding application, draw.io relies on an internal export service to process complex rendering tasks. The security failure originates from how the servlet constructs the target URL for these requests. Specifically, the code utilizes request.getPathInfo() to extract a path segment from the incoming HTTP request and appends it directly to a predefined EXPORT_URL without performing any validation or normalization of the input. This architectural oversight allows an attacker to manipulate the file system navigation characters within the URL path, effectively bypassing intended access controls that are supposed to restrict interactions to specific internal endpoints.
From a technical perspective, this flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. By including dot segments such as ../ or ./ within the path info parameter, an unauthenticated attacker can traverse outside the intended directory structure on the internal export server. Because the servlet does not reject these traversal sequences nor verify that the normalized destination remains within the configured safe boundary, it inadvertently exposes sensitive areas of the application infrastructure. This lack of input sanitization is a fundamental error in handling user-supplied data as part of a system command or URL construction, leading to unauthorized access patterns that were never intended by the developers.
The operational impact of this vulnerability extends beyond simple directory traversal due to the behavior of the proxy servlet regarding HTTP headers and body content. The ExportProxyServlet forwards all request headers and the entire request body from the client directly to the internal export service without filtering or modification. This characteristic enables an attacker to perform arbitrary header injection attacks, which can be leveraged for Server-Side Request Forgery (SSRF) scenarios if the internal server processes injected headers in a way that alters its behavior. Depending on the specific configuration of the export service, exploitation can lead to the exposure of administration panels, debugging interfaces, health check endpoints, and sensitive configuration files. In more severe configurations, this could permit unintended internal actions, potentially allowing an attacker to interact with backend services as if they were an authorized user or system component.
This vulnerability aligns with several techniques in the MITRE ATT&CK framework, particularly T1071: Application Layer Protocol for command and control communications when used to exfiltrate data via headers, and T1598: Phishing for Information about Network Resources if leveraged to probe internal services. The ability to access health or configuration endpoints provides attackers with valuable reconnaissance information that can facilitate further attacks against the infrastructure. Since the vulnerability exists in a component accessible prior to authentication, it poses a significant risk to any deployment of draw.io running versions older than 30.2.7. Organizations must prioritize patching this software immediately to close these attack vectors and prevent potential data breaches or unauthorized control over internal services.
To mitigate this issue, administrators should upgrade draw.io to version 30.2.7 or later, where the ExportProxyServlet has been updated to properly validate and normalize path inputs before appending them to the export URL. Implementing strict allowlists for permitted paths rather than relying on blacklist-based filtering of traversal characters is a recommended best practice. Additionally, deploying web application firewalls that can detect and block HTTP request smuggling or header injection attempts may provide an additional layer of defense during the transition period. Regular security audits focusing on how user input influences internal service calls are essential to prevent similar path manipulation vulnerabilities in other components of the application stack.