What’s Vulnerable › Vulnerabilities

CVE-2026-114606: draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)

• Severity: medium (CVSS 5.6 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-30
• Weakness: CWE-22

Description

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFile actions operate on a renderer-chosen filesystem path with no blessed-path (assertWritablePath) authorization. The only gates are validateSender — a URL-prefix origin check — plus, for readFile alone, a content "sniff" and a lexical appBaseDir prefix block. The write-side handlers (saveFile, writeFile, saveDraft, deleteFile) are all protected by assertWritablePath; the read side is not. The result is a read/write authorization asymmetry: any frame executing in the app's file:// origin can read the contents of local files that the same origin is explicitly forbidden to write. This issue is fixed in version 31.4.4.

Affected products

• jgraph drawio-desktop: before 31.4.4

References

• https://github.com/jgraph/drawio-desktop/commit/9c933514b8bcc90a91d88c685525a8885de4027e
• https://github.com/jgraph/drawio-desktop/releases/tag/v31.4.4
• https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-fjgc-8xgj-rvh4
• https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-fjgc-8xgj-rvh4

Get alerted when CVE-2026-114606 or the next vulnerability affects your stack