The flaw in draw.io’s ExportProxyServlet permits arbitrary path traversal by appending unsanitized path segments to an internal export URL. This bypasses intended boundaries and lets an unauthenticated user reach any internal endpoint, including administrative, debugging, or configuration services, and inject arbitrary headers into the forwarded request. The weakness is a classic directory traversal exposed by CWE-22 and results in unauthorized internal information exposure and potential internal actions.

Versions of draw.io up to and including 30.2.6 are affected, as the vulnerability exists before the supplier released version 30.2.7 where the logic was corrected. The product is jgraph:drawio. Any deployment of the desktop or web versions prior to the patched release is vulnerable.

The CVSS score of 3.7 indicates moderate severity, and the EPSS score is presently undisclosed. Because the attack requires only an unauthenticated HTTP request to the ExportProxyServlet, exploitation is straightforward for anyone with network access to the application. Although not listed in CISA’s KEV catalog, organizations should still consider this a risk due to the potential exposure of sensitive internal endpoints.