draw.io Desktop EUVD-2026-108231

Exploitation requires attacker-controlled script already running in draw.io Desktop's app file:// origin, which per the advisory means a reachable renderer XSS in the drawio webapp (the AT:P attack requirement) and a victim actively opening a malicious diagram file (UI:A). Only then can the un-gated readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFile IPC actions be abused. The readable set is further limited by readFile's checkFileContent sniff, which admits only files whose leading bytes match the diagram/JSON/HTML/PDF/PNG/JPEG/WebP/zip/mx* allowlist or whose extension is .mmd/.mermaid (so JSON/INI/TOML configs beginning with '{' or '[' pass), and by the lexical appBaseDir prefix block that merely excludes the install directory; getFileDrafts/getBkpFile are limited to .$<base>.dtmp/.bkp sibling name patterns. Limiting factors for defenders: attack is local (AV:L), needs a chained XSS, needs user interaction, and yields read-only disclosure - it cannot write or modify files. The only complete fix is updating to 31.4.4; the vendor states there is no user-facing mitigation for the read-side gap beyond opening diagrams only from trusted sources and keeping the app and its webapp submodule updated.

This is a genuine but conditional confidentiality flaw, not a drive-by emergency. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N = 5.6 Medium) is internally consistent with the advisory: AV:L and AT:P/UI:A reflect that exploitation is not remote-unauthenticated against draw.io itself - it is a local primitive that only becomes reachable once an attacker already has script execution in the app's file:// origin, which the advisory states requires a separate renderer XSS in the drawio webapp plus the user opening a malicious diagram. VC:H with VI:N/VA:N correctly captures a read-only disclosure with no write/integrity or availability impact (the companion write-side handlers remain protected by assertWritablePath). No EPSS score, no CISA KEV listing, and no SSVC automatable/technical-impact breakdown were supplied; the only priority signal is the vuln.today Decision label 'this_month', which aligns with a Medium-severity, precondition-gated issue rather than act_now/emergency. The advisory includes a step-by-step proof-of-concept for the main-process read primitive but does not package a working end-to-end exploit (the enabling renderer XSS is explicitly out of scope of this defect). Net: a real, worth-patching authorization-asymmetry bug, but its practical risk is bounded by needing a chained XSS and user interaction, so it is a planned-patch priority, not a widespread-exploitation crisis. Missing data to note: no EPSS and no KEV status were provided, so exploitation-probability cannot be quantified.

An attacker first achieves script execution in draw.io Desktop's file:// origin via a renderer XSS in the drawio webapp, typically by getting the victim to open a malicious diagram file. From that origin the attacker calls the preload bridge's readFile IPC action with an absolute path to a sensitive local file (e.g. a JSON config whose first byte is '{'), and the Electron main process returns its bytes verbatim because the read side lacks the blessed-path check the write side enforces. The vendor advisory documents this as a working proof-of-concept of the primitive, though the enabling XSS is a separate precondition.