CVE-2022-1721

2022-05-1615:15:10

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.0%

JSON

Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application.

CPENameOperatorVersion
drawioeq7.3.9
drawioeq7.7.6
drawioeq6.8.7
drawioeq11.2.0
drawioeq12.9.8
drawioeq16.2.2
drawioeq6.7.10
drawioeq14.6.10
drawioeq13.7.8
drawioeq15.2.7

Name	Operator	Version
drawio	eq	7.3.9
drawio	eq	7.7.6
drawio	eq	6.8.7
drawio	eq	11.2.0
drawio	eq	12.9.8
drawio	eq	16.2.2
drawio	eq	6.7.10
drawio	eq	14.6.10
drawio	eq	13.7.8
drawio	eq	15.2.7

Rows per page:

1-10 of 8291

References

github.com/jgraph/drawio/commit/01ccb271d34258872b859c0fc1d253cc81341917

huntr.dev/bounties/000931cc-6d0e-4a4f-b4d8-4ba46ba0e699