draw.io CVE-2026-63416

Requires a self-hosted draw.io server (jgraph/drawio) running a version prior to 30.2.7 that exposes ExportProxyServlet and is configured to proxy to an internal export server. Exploitation is unauthenticated (PR:N) and needs no user interaction, but its impact is strictly bounded by the export service configuration: the attacker only gains value if the internal export backend actually hosts reachable administration, debugging, health, or configuration endpoints, or accepts state-changing actions - this is the AC:H limiting factor. The traversal is delivered via dot segments (literal or percent-encoded %2e/%2f/%5c, or backslash) in the request path info. Deployments without the export proxy feature, or where the backend exposes no sensitive routes, are not meaningfully exposed.

This is a low-to-moderate priority issue where the vendor's own CVSS score (3.7) is a reasonable reflection of real-world risk, though arguably conservative. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) correctly flags unauthenticated network reachability but assigns AC:H because impact is entirely contingent on the export service's configuration - the traversal only becomes meaningful if the internal export server actually exposes administration, debugging, health, or configuration endpoints reachable from the proxy. No EPSS score, KEV listing, or POC is present in the provided data, and no SSVC decision was supplied, so exploitation-probability signals are absent rather than conflicting. Two points warrant scrutiny: (1) the vendor scored S:U and I:N, but the description explicitly says the servlet 'forwards all request headers and the request body' to reach internal routes and can 'permit unintended internal actions' - that reads as a scope change into a separate internal backend with at least limited integrity impact, so I independently assess S:C/I:L (see assessed vectors). (2) The commit fixed this alongside a DNS-rebinding SSRF (GHSA-3v4h-8r2c-m8c5) and an OAuth CSRF hardening (GHSA-mcj5-3pww-7g49) in the same 30.2.7 release; those are distinct CVEs and should not be conflated with this traversal. Net: real but conditional - dangerous only for self-hosted draw.io servers whose internal export backend hosts sensitive endpoints.

An unauthenticated attacker sends an HTTP request to a self-hosted draw.io server's export proxy with dot-segment traversal in the path info (e.g. encoded ../ sequences), causing the servlet to resolve a URL outside the configured export base and forward the attacker's headers and body to an internal export-server endpoint such as /admin, /debug, or /health. Depending on how the backend export service is configured, this can leak configuration or health data or trigger unintended internal actions. No public exploit code is identified in the provided data, and the AC:H rating reflects that success hinges on the specific backend endpoints exposed.