The vulnerability in draw.io enables attackers to perform server‑side request forgery via DNS rebinding. During request validation a hostname is resolved to a public IP, but when the proxy opens the connection a second DNS resolution occurs, allowing the hostname to resolve to a private address, link‑local address, or a cloud instance metadata service. Successful exploitation can retrieve internal HTTP responses or cloud metadata, compromising confidentiality and potentially aiding further attacks.

Deployments of jgraph:drawio running with ENABLE_DRAWIO_PROXY enabled on any version prior to 30.2.7 are affected. The issue is fixed in v30.2.7 and later releases.

The CVSS score of 6.8 indicates medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attacker controls the hostname and only needs remote access to the application, the exploitation path is realistic for environments where the proxy is enabled. The attack requires the attacker to be able to resolve a hostname that can change between validation and actual request time, making DNS configuration a key factor in risk assessment.