# CVE-2026-97373: draw.io incomplete SSRF blocklist in proxy endpoint

Source: https://junglewise.ai/threats/cve-2026-97373-draw-io-is-a-configurable-diagramming-and-whiteboarding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-97373 · Severity: medium · CVSS 5.8 · Published 2026-11-04

draw.io is a diagramming and whiteboarding application that can optionally expose a /proxy endpoint for fetching remote content. The proxy endpoint's security filter fails to block requests to the RFC 6598 Carrier-Grade NAT address range (100.64.0.0/10), allowing an unauthenticated attacker to access internal services in Kubernetes, cloud deployments, or overlay networks, potentially disclosing sensitive data.

Technologies: [JGraph Draw.Io](https://junglewise.ai/threats/technologies/jgraph-draw-io). Vendors: [JGraph](https://junglewise.ai/threats/vendors/jgraph).

## Quick answers

**Is CVE-2026-97373 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97373 being exploited in the wild.

**How severe is CVE-2026-97373?** Medium severity, with a CVSS score of 5.8, published 4 November 2026.

**Which products and versions are affected?** JGraph Draw.Io prior to 30.3.8.

**Is there a fix for CVE-2026-97373?** Yes: fixed in 30.3.8. Until then: Disable the optional /proxy endpoint by not setting ENABLE_DRAWIO_PROXY=1 unless required for legitimate use; restrict network access to the /proxy endpoint at the network perimeter to trusted clients. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97373 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97373?** Check whether you run JGraph Draw.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 30.3.8

Disable the optional /proxy endpoint by not setting ENABLE_DRAWIO_PROXY=1 unless required for legitimate use; restrict network access to the /proxy endpoint at the network perimeter to trusted clients.

## Technical details

The vulnerability is an incomplete server-side request forgery (SSRF) blocklist in Utils.sanitizeUrl() which validates URLs for the optional /proxy endpoint. The blocklist omits RFC 6598 CGNAT range 100.64.0.0/10, while blocking other private ranges (RFC 1918, loopback, link-local). An unauthenticated remote attacker can bypass the filter by requesting http://100.64.0.x addresses, forcing the draw.io server to fetch from internal services reachable in that range, such as EKS pod IPs, OCI internal endpoints, or Tailscale peers.

## Affected products

- jgraph draw.io prior to 30.3.8

## Timeline

- 2026-07-14: disclosed
- 2026-07-14: patched
- 2026-11-04: advisory

## References

- [https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d](https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d)
- [https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q](https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q)

## Related threats

- [draw.io prototype pollution in GraphML decoder](https://junglewise.ai/threats/cve-2026-115762-draw-io-is-a-configurable-diagramming-and-whiteboarding)
- [draw.io IPv6 ULA address bypass in URL validation](https://junglewise.ai/threats/cve-2026-76898-draw-io-is-a-configurable-diagramming-and-whiteboarding)
- [draw.io OAuth state validation bypass in self-hosted deployments](https://junglewise.ai/threats/cve-2026-63373-draw-io-is-a-configurable-diagramming-and-whiteboarding)
- [draw.io server-side request forgery via proxy configuration](https://junglewise.ai/threats/cve-2026-63334-draw-io-is-a-configurable-diagramming-and-whiteboarding)
- [draw.io stored XSS via crafted .drawio file in TextFormatPanel](https://junglewise.ai/threats/cve-2026-58504-draw-io-is-a-configurable-diagramming-and-whiteboarding)