CVE-2026-76898 draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the...

CVE-2026-76898

draw.io prior to version 30.3.8 is vulnerable to an unauthenticated SSRF via an IPv6 ULA blocklist bypass in /embed2.js. The root cause is in Utils.sanitizeUrl(), which checks for IPv6 ULA addresses by comparing the literal text prefixes fc00:: and fd00::, but the JDK returns the expanded address...

CVE-2026-76898 draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the...

Embed2 SSRF

The vulnerability of the url.openConnection method in Embed2 software, which is used for creating drawio diagrams, is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack by sending a specially crafted HTTP...

PT-2022-3218

Name of the Vulnerable Software and Affected Versions drawio versions prior to 18.0.8 Description The issue is related to insufficient validation of incoming requests in the url.openConnection function of the Embed2 servlet in the drawio diagram-building software. This can be exploited by a remot...