CVE-2026-114606: draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)
draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFile actions operate on a renderer-chosen filesystem path with no blessed-path (assertWritablePath) authorization. The only gates are validateSender — a URL-prefix origin check — plus, for readFile alone, a content "sniff" and a lexical appBaseDir prefix block. The write-side handlers (saveFile, writeFile, saveDraft, deleteFile) are all protected by assertWritablePath; the read side is not. The result is a read/write authorization asymmetry: any frame executing in the app's file:// origin can read the contents of local files that the same origin is explicitly forbidden to write. This issue is fixed in version 31.4.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
draw.io Desktopto a version that resolves this vulnerability.Fixed in 31.4.4
Event History
Frequently Asked Questions
Which installations are affected?
draw.io Desktop versions prior to 31.4.4 are affected. The issue applies to the official Electron desktop build.
What does an attacker need to exploit this issue?
An attacker needs code executing in a frame with the application's file:// origin, because the IPC handlers use a URL-prefix sender validation. That frame can supply filesystem paths to read-side IPC actions.
What data can be accessed?
The unprotected read-side actions can read local files and query file-related information using renderer-chosen paths. The affected actions include readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFile.
Are file modifications possible through the same weakness?
The described authorization gap affects read-side handlers. Write-side handlers, including saveFile, writeFile, saveDraft, and deleteFile, are protected by assertWritablePath.
How can the issue be remediated?
Update draw.io Desktop to version 31.4.4, which fixes the issue.