CVE-2026-97373: draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts
draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
draw.ioto a version that resolves this vulnerability.Fixed in 30.3.8
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running a version prior to 30.3.8 are exposed only if the optional /proxy endpoint is enabled. The impact depends on whether the draw.io server can reach services addressed within 100.64.0.0/10.
Does exploitation require authentication or user interaction?
No. An unauthenticated remote attacker can exploit the issue without user interaction by causing the server to request a reachable address in the RFC 6598 shared address range.
What should be done if upgrading is not immediately possible?
Disable the optional /proxy endpoint where possible. Also restrict the draw.io server's network access to services in 100.64.0.0/10 to reduce the reachable internal targets.
How can I determine whether the issue applies to my environment?
Check whether /proxy is enabled and whether the deployed draw.io version is earlier than 30.3.8. Then determine whether the server has network routes or access to hosts in 100.64.0.0/10, including CGNAT, Kubernetes, cloud, or overlay-network services.