{"affected":[{"product":"drawio","source":"CNA: GitHub_M","vendor":"jgraph","versions":[{"status":"affected","version":"< 30.3.8"}]}],"cveId":"CVE-2026-97373","cwes":["CWE-918"],"description":"draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.8,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1793825571964,"publishedAt":1793825571964,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d"}],"remediation":[],"revision":"b90e33de6f39e51be1d2aa88ef702e3b4a33cdc3b44acfb00468e96614c2dab8","sources":[{"modifiedAt":1793825571964,"name":"CNA: GitHub_M","retrievedAt":1793826780348,"url":"https://www.cve.org/CVERecord?id=CVE-2026-97373"}],"ssvc":null,"status":"published","title":"draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts","updatedAt":1793826780348}