CVE-2026-63416: draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORTURL without rejecting dot segments or confirming that the normalized destination remains under the configured export path. An unauthenticated request containing traversal segments can therefore address unintended routes on the internal export server, and the servlet forwards all request headers and the request body to that destination, allowing arbitrary header injection. Depending on the export service configuration, exploitation can expose administration, debugging, health, or configuration endpoints and can permit unintended internal actions. This issue is fixed in version 30.2.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
draw.ioto a version that resolves this vulnerability.Fixed in 30.2.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it by sending a request containing traversal segments to the affected servlet. Exploitation depends on the attacker being able to reach the draw.io deployment over the network.
What determines the impact in a particular deployment?
Impact depends on the configuration and endpoints exposed by the internal export service. Traversal may provide access to administration, debugging, health, or configuration routes, and forwarded headers and request bodies may enable unintended internal actions.
Are default configurations known to be affected?
The available information describes this as affecting configurable draw.io deployments but does not state whether a default export-service configuration exposes sensitive routes. Review the configured export URL and the routes available on its backend.
What should be done if upgrading is not immediately possible?
Restrict network access to the affected draw.io servlet and to the internal export service, and limit the export service to only the routes required for normal operation. Ensure administrative, debugging, health, and configuration endpoints are not reachable through the export backend.
How can defenders identify potentially malicious requests?
Review requests to the ExportProxyServlet for path traversal dot segments in path information, especially requests attempting to reach unexpected export-backend routes. Also investigate requests carrying unusual headers or request bodies, since the servlet forwards both to the destination.