CVE-2026-114606

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFil...

CVE-2026-114606

Versions of draw.io Desktop prior to 31.4.4 are vulnerable to arbitrary local-file disclosure . The root cause is an authorization asymmetry in the Electron main process's read-side IPC handlers. While write-side handlers (such as saveFile and writeFile) are protected by assertWritablePath, the r...

CVE-2026-114606 draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFil...

EUVD-2026-108231

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFil...