Description

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or confirming that the normalized destination remains under the configured export path. An unauthenticated request containing traversal segments can therefore address unintended routes on the internal export server, and the servlet forwards all request headers and the request body to that destination, allowing arbitrary header injection. Depending on the export service configuration, exploitation can expose administration, debugging, health, or configuration endpoints and can permit unintended internal actions. This issue is fixed in version 30.2.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-21T17:17:39.503Z",
  "pubdate": "2026-09-21T17:17:39.503Z",
  "executiveSummary": "The ExportProxyServlet in draw.io prior to version 30.2.7 is susceptible to a path traversal vulnerability that facilitates unauthorized access to internal resources. This flaw stems from the insecure handling of request.getPathInfo() data, which is concatenated directly into the internal EXPORT_URL destination without proper validation or normalization of dot segments.\nBy crafting malicious requests containing path traversal sequences, an unauthenticated attacker can bypass intended access controls to address arbitrary endpoints on the internal export server. The vulnerability enables the proxying of request headers and bodies to sensitive locations, including administration, debugging, and configuration interfaces.\nThe primary risk implications include potential exposure of internal infrastructure, sensitive configuration data, and the ability to perform unintended operations on internal services that are otherwise protected from external exposure. Exploitation is possible without prior authentication, requiring only the ability to reach the ExportProxyServlet. This vulnerability effectively turns the affected component into a powerful server-side request forgery (SSRF) proxy. Organizations using draw.io are exposed to internal network compromise if the export server has access to sensitive internal management interfaces.\nThis issue is addressed in version 30.2.7, and immediate application of this update is required to remediate the flaw.",
  "technicalDetails": "The vulnerability is located within the src/main/java/com/mxgraph/online/ExportProxyServlet.java component. The root cause is the improper validation of input derived from request.getPathInfo(). The application logic takes the path information provided in the HTTP request and directly appends it to a predefined base URL (EXPORT_URL) used for internal communication with the export service.\nBecause the servlet fails to sanitize the input by rejecting dot segments (e.g., '../') or performing canonicalization to ensure the resolved path remains within the intended scope, an attacker can manipulate the destination URL. When the servlet constructs the final proxyPath, it essentially ignores the security boundary established for the export service. Consequently, any request directed at the proxy can be redirected to arbitrary paths on the destination server.\nThe attack flow proceeds as follows: An attacker sends an HTTP request to the vulnerable servlet, injecting traversal sequences into the URI path. Upon receiving the request, ExportProxyServlet.java constructs a malicious proxyPath by concatenating the traversal segments with the EXPORT_URL. The servlet then forwards the request, including all original HTTP headers and the request body, to the resulting target URI. This enables the attacker to interact with any endpoint on the internal export server that the server process is capable of reaching.\nThis vulnerability is critical due to the unrestricted nature of the forwarded headers. If the internal export server exposes administrative, health check, or debugging endpoints—which are frequently devoid of complex authentication requirements when accessed via 'trusted' internal network paths—an attacker can gain unauthorized access to those functions. Furthermore, because the proxying mechanism includes the request body, an attacker can perform state-changing operations (such as POST or PUT requests) against these internal endpoints, potentially modifying configurations or triggering unintended actions.\nThe impact is significant because it allows an attacker to pivot from an external, unauthenticated position to interact with internal-only network resources. The exposure of sensitive internal infrastructure can lead to further exploitation, information disclosure, or service disruption depending on the specific functions exposed by the internal export server."
}