CVE-2026-63416: draw.io Path Traversal Vulnerability

CVE-2026-63416 Overview

CVE-2026-63416 is a path traversal vulnerability [CWE-22] in draw.io, a configurable diagramming and whiteboarding application. The flaw resides in src/main/java/com/mxgraph/online/ExportProxyServlet.java, which uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL. The servlet does not reject dot segments or verify that the normalized destination remains under the configured export path. An unauthenticated attacker can send traversal segments to reach unintended routes on the internal export server. Because the servlet forwards all request headers and the body to that destination, arbitrary header injection is also possible. The issue is fixed in version 30.2.7.

Critical Impact
Unauthenticated attackers can address internal administration, debugging, health, or configuration endpoints on the export server and trigger unintended internal actions.

Affected Products

draw.io versions prior to 30.2.7
Deployments exposing ExportProxyServlet to untrusted networks
Self-hosted draw.io export servers reachable through the proxy servlet

Discovery Timeline

2026-09-21 - CVE-2026-63416 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-63416

Vulnerability Analysis

The ExportProxyServlet component acts as a reverse proxy between clients and the draw.io export service. It reads the incoming request path via request.getPathInfo() and concatenates the value onto a base EXPORT_URL without normalization or containment checks. This allows dot-segment sequences such as ../ to escape the intended export path prefix.

Once the destination URL is constructed, the servlet forwards the client's headers and body to the resolved endpoint. An attacker can therefore both redirect the proxied request and inject controlled headers into the internal call. Depending on the export service configuration, this exposes administration, debugging, health, or configuration endpoints that were never intended to be reachable from the outside.

Root Cause

The root cause is missing input validation on the proxy path. The servlet trusts getPathInfo() output, performs no URL normalization, and does not verify that the resolved target remains under the configured export path prefix before issuing the outbound request.

Attack Vector

The attack vector is network-based and requires no authentication. An adversary sends a crafted HTTP request containing traversal segments in the path handled by ExportProxyServlet. Custom headers included in the request are forwarded verbatim to the internal endpoint, enabling header injection alongside the path traversal.

See the GitHub Security Advisory GHSA-3pq9-9hg4-ggfw for advisory details. No public exploit code was referenced in the enriched data.

Detection Methods for CVE-2026-63416

Indicators of Compromise

HTTP requests to the draw.io proxy endpoint containing ../, ..%2f, or other encoded dot-segment sequences in the path
Outbound requests from the draw.io host to internal export-server routes outside the expected export path prefix
Unusual custom headers appearing on internal export-server logs originating from the proxy servlet

Detection Strategies

Inspect web server and reverse proxy logs for path components targeting ExportProxyServlet that contain traversal characters or reference administrative, health, or debug routes
Correlate inbound proxy requests with outbound internal requests to identify path prefixes that fall outside the configured export URL
Alert on internal export-server access to management endpoints from the draw.io service account

Monitoring Recommendations

Enable verbose access logging on both the draw.io front end and the internal export service to preserve full request paths and headers
Track HTTP 4xx and 5xx responses from the export server, which may indicate probing for internal routes
Monitor for spikes in requests to the proxy servlet from a single source address

How to Mitigate CVE-2026-63416

Immediate Actions Required

Upgrade draw.io to version 30.2.7 or later, which contains the fix committed in jgraph/drawio commit 650fbd7
Restrict network access to ExportProxyServlet so it is not reachable from untrusted networks
Audit internal export-server logs for prior access to administration, debug, health, or configuration endpoints

Patch Information

The patched release is available as draw.io v30.2.7. The upstream fix updates ExportProxyServlet handling as tracked in the commit history. The VERSION file bump reflects the release:

text

-30.2.6
+30.2.7

Source: jgraph/drawio commit 650fbd7

Workarounds

Place a reverse proxy or web application firewall in front of draw.io to reject requests containing .., %2e%2e, or other dot-segment encodings in the proxy path
Enforce network segmentation so the internal export server exposes only the intended export routes to the draw.io front end
Disable or block the ExportProxyServlet route until upgrading to 30.2.7

bash

# Example NGINX rule to block path traversal on the draw.io proxy endpoint
location /proxy/ {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e/)") {
        return 400;
    }
    proxy_pass http://drawio_backend;
}