{"id":"CVE-2026-97373","aliases":[],"cve":{"records":[{"id":"CVE-2026-97373","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-24T14:16:20.200Z","published":"2026-11-04T20:52:51.964Z","modified":"2026-11-09T16:58:10.960Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-11-04T20:52:51.964Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T16:58:10.960Z"}],"references":[{"url":"https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T16:33:53.413943Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.","score":5.8,"severity":"medium","published":"2026-11-04T20:52:51.964Z","modified":"2026-11-09T16:58:10.960Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"jgraph","name":"drawio","platforms":[],"versions":[{"version":"< 30.3.8","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-97373"}],"remediation":[],"references":["https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q","https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d"],"sources":[{"name":"CVE","id":"CVE-2026-97373","modified":"2026-11-09T16:58:10.960Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-97373"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":5.8}],"sourceAffected":[],"observedAt":"2026-11-09T17:08:42.977Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:35:33.875Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-05T05:30:41.991Z","attemptedAt":"2026-11-05T05:30:41.991Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-05T05:55:34.161Z","attemptedAt":"2026-11-05T05:55:34.161Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-05T05:55:35.108Z","attemptedAt":"2026-11-05T05:55:35.108Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-05T05:30:40.830Z","attemptedAt":"2026-11-05T05:30:40.830Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-97373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97373","modified":"2026-11-04T21:18:17.063","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","checkedAt":"2026-11-05T05:30:41.991Z"},{"source":"ENISA EUVD","id":"EUVD-2026-117101","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117101","modified":"Nov 4, 2026, 8:52:51 PM","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","checkedAt":"2026-11-05T05:55:35.108Z"}],"aiSummary":{"text":"draw.io versions prior to 30.3.8 have an incomplete SSRF blocklist, allowing unauthenticated attackers to request internal services in the 100.64.0.0/10 range. This may disclose data from internal hosts. The vulnerability is fixed in version 30.3.8.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-04T21:51:04.437Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-97373"}]}}