← CVE Radar
CVE-2026-97373draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts
draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.
5.8 MEDIUMEPSS 0.24%Not in KEVNVD: Received
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 5.8 | MEDIUM | 3.1GitHub_M (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
Details
- CVE ID
- CVE-2026-97373
- Status
- Received
- Assigner (CNA)
- GitHub_M
- Published
- Nov 4, 2026
- Last modified
- 2026-11-04 21:18 UTC
- Weaknesses
- CWE-918 · Server-Side Request Forgery (SSRF)
Affected Products
As published by the CNA in the CVE record.
jgraphdrawio1 version range
- < 30.3.8