# CVE-2026-114606: draw.io Desktop arbitrary local file disclosure

Source: https://junglewise.ai/threats/cve-2026-114606-draw-io-desktop-is-the-official-electron-build-of-draw-io-prior  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-114606 · Severity: info · Published 2026-10-22

draw.io Desktop is a diagram editing application built on Electron for creating flowcharts, UML diagrams, and other visual content. Prior to version 31.4.4, attackers could read arbitrary files on the user's system by opening a specially crafted diagram file and exporting it, potentially exposing sensitive documents, configuration files, and private data. The vulnerability exploited a disparity in security controls between reading and writing files through the application's inter-process communication handlers.

Vendors: [JGraph](https://junglewise.ai/threats/vendors/jgraph).

## Quick answers

**Is CVE-2026-114606 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114606 being exploited in the wild.

**How severe is CVE-2026-114606?** Informational severity, published 22 October 2026.

**Which products and versions are affected?** JGraph draw.io Desktop before 31.4.4.

**Is there a fix for CVE-2026-114606?** Yes: fixed in 31.4.4. Until then: Upgrade to draw.io Desktop 31.4.4 or later. Do not open diagram files (.drawio) from untrusted sources, as a crafted diagram can exploit this vulnerability when opened and exported. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114606 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2026-114606?** Check whether you run JGraph draw.io Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 31.4.4

Upgrade to draw.io Desktop 31.4.4 or later. Do not open diagram files (.drawio) from untrusted sources, as a crafted diagram can exploit this vulnerability when opened and exported.

## Technical details

The Electron main process's IPC read handlers (readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, watchFile) lacked proper path authorization checks, while write-side handlers were protected by assertWritablePath validation. An attacker could craft a diagram with a malicious font source pointing to arbitrary local file paths; since the renderer-controlled fontSource is fetched via readFile and embedded in exports, opening and exporting the diagram allows arbitrary file disclosure. The validateSender origin check alone was insufficient to prevent this attack vector, as diagram content reaches IPC handlers independently.

## Affected products

- jgraph draw.io Desktop before 31.4.4

## Timeline

- 2026-10-22: disclosed
- 2026-09-06: patched: Version 31.4.4 released

## References

- [https://github.com/jgraph/drawio-desktop/commit/9c933514b8bcc90a91d88c685525a8885de4027e](https://github.com/jgraph/drawio-desktop/commit/9c933514b8bcc90a91d88c685525a8885de4027e)
- [https://github.com/jgraph/drawio-desktop/releases/tag/v31.4.4](https://github.com/jgraph/drawio-desktop/releases/tag/v31.4.4)

## Related threats

- [draw.io Desktop path traversal privilege escalation on Windows](https://junglewise.ai/threats/cve-2026-119333-draw-io-desktop-is-the-official-electron-build-of-draw-io-prior)