draw.io Desktop's Electron main process contains IPC handlers that permit reading arbitrary local files. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFile actions process renderer‑provided file paths without a blessed‑path gate. A sender validation only checks the URL prefix, while readFile has an additional content sniff and a lexical appBaseDir prefix block, but these are insufficient. An attacker who controls a renderer frame in the app’s file:// origin can therefore read files that the same origin is forbidden to write, leading to confidential data exposure.

The vulnerability affects the draw.io Desktop application (Electron build) from jgraph, on all versions prior to 31.4.4. The affected product is the official desktop client and the main process IPC handlers are unprotected for read operations.

The CVSS score is 5.6, classifying the flaw as medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack likely requires an attacker to execute code within the desktop application's file:// origin, such as by loading a malicious local HTML file or exploiting an existing renderer process. Once the attacker controls the renderer context, they can invoke the vulnerable read‑side IPC methods to retrieve any files accessible to that origin. Given the lack of a blessed‑path check, the risk of sensitive local‑file disclosure remains significant for users running the application with untrusted content.