draw.io Desktop EUVD-2026-114398

Windows only. draw.io Desktop must NOT already be running so that cold-opening a diagram from File Explorer makes the diagram's folder the current working directory. The victim must extract an attacker-supplied archive and open the legitimate .drawio file from that attacker-controlled directory (required user interaction). The powershell.exe hijack path triggers only when the Local Fonts feature is enabled; the attrib.exe hijack path triggers when draft or backup file attributes are updated (e.g. on automatic save). Limiting factors: local vector only (no network reach), dependence on victim extracting and opening the file while the app is closed, and the Local-Fonts/draft-backup conditions. Affected versions <=31.4.5; fixed in 31.5.2, which invokes system binaries by absolute System32 path and sets NoDefaultCurrentDirectoryInExePath.

CVSS base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting a local, user-interaction-dependent attack that yields full confidentiality, integrity and availability impact via arbitrary code execution in the user's context. This is a genuine code-execution flaw (CWE-426, untrusted search path), not merely an information-disclosure issue as one input tag suggests. The vendor priority label is 'this_week', consistent with a serious but not emergency-grade issue. No CISA KEV listing is present in the input, so there is no confirmed active exploitation; no EPSS score was supplied, so statistical exploitation probability cannot be weighed. A detailed step-by-step PoC is published in the GHSA advisory, but the input does not mark it as verified working exploit code, so treat it as a public PoC reference rather than a confirmed weaponized exploit. The real-world risk is tempered by the local attack vector and the requirement that the victim extract an attacker-supplied archive and cold-open a legitimate .drawio file while draw.io Desktop is not already running (so Explorer sets the diagram folder as the working directory) - a realistic social-engineering/supply-of-archive scenario but one that depends on victim action and timing rather than remote network reachability. Net: a credible this-week priority for Windows draw.io Desktop users, especially where archives from untrusted sources are opened, but not an internet-facing mass-exploitation threat.

An attacker builds a ZIP archive containing a legitimate .drawio diagram alongside a malicious powershell.bat or attrib.exe and delivers it to a victim (e.g. by email or download). The victim extracts the archive and double-clicks the .drawio file from the extracted folder while draw.io Desktop is closed, so that folder becomes the process working directory; draw.io then resolves the attacker's colocated binary ahead of the genuine Windows system executable (when Local Fonts are enabled, or when draft/backup file attributes are set), executing attacker code in the victim's context. A detailed PoC exists in the GHSA advisory, though it is not marked as verified working exploit code.