CVE-2026-63416

draw.io (a diagramming and whiteboarding application) is affected by a path traversal vulnerability in ExportProxyServlet.java prior to version 30.2.7 . The servlet uses request.getPathInfo() to build a proxy path and appends it directly to EXPORT_URL without rejecting dot segments or verifying t...

CVE-2026-63416 draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo to build a proxyPath and appends it directly to EXPORTURL without rejecting dot segments or confirming that the normalize...