CVE-2026-97373

The diagramming application draw.io contains a Server-Side Request Forgery (SSRF) vulnerability in its optional /proxy endpoint prior to version 30.3.8 . The root cause is an incomplete blocklist in the URL validator (specifically within ProxyServlet and Utils.sanitizeUrl), which fails to reject ...

EUVD-2026-84009

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the...

CVE-2026-76898: Server-Side Request Forgery (SSRF)

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the...

PT-2026-96158

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.2.7 Description Deployments with ENABLE DRAWIO PROXY=1 are susceptible to server-side request forgery. This occurs because the Utils.sanitizeUrl function in src/main/java/com/mxgraph/online/Utils.java performs a...

PT-2026-96160

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.3.8 Description An issue exists where the application fails to properly block IPv6 Unique Local Addresses ULA because the check in Utils.sanitizeUrl compares text prefixes fc00:: and fd00:: while the JDK returns...