CVE-2026-114606

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFile actions operate on a renderer-chosen filesystem path with no blessed-path (assertWritablePath) authorization. The only gates are validateSender — a URL-prefix origin check — plus, for readFile alone, a content "sniff" and a lexical appBaseDir prefix block. The write-side handlers (saveFile, writeFile, saveDraft, deleteFile) are all protected by assertWritablePath; the read side is not. The result is a read/write authorization asymmetry: any frame executing in the app's file:// origin can read the contents of local files that the same origin is explicitly forbidden to write. This issue is fixed in version 31.4.4.

• CWE-22
• CWE-200

• https://github.com/jgraph/drawio-desktop/commit/9c933514b8bcc90a91d88c685525a8885de4027e
• https://github.com/jgraph/drawio-desktop/releases/tag/v31.4.4
• https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-fjgc-8xgj-rvh4

Published

Oct 22, 2026

Last Modified

Oct 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114583tarfile.tar_filter could be bypassed using crafted link entr…6.9
• CVE-2026-11459A security vulnerability has been detected in SecureAge Catc…3.3
• CVE-2026-1146A vulnerability has been found in SourceCodester/Patrick Mvu…5.4
• CVE-2026-11460A flaw has been found in Boost Serialization up to 1.91. The…7.3
• CVE-2026-114603OpenTelemetry Python provides the Python API and SDK for Ope…5.3
• CVE-2026-114605dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.n…7.5
• CVE-2026-114607Better Auth is an authentication and authorization library f…9.1
• CVE-2026-114608Pylint is a static code analyser for Python. From 0.15.2 unt…5.4
• CVE-2026-114609fpdf2 is a PDF creation library for Python. Prior to 2.8.8, …5.8
• CVE-2026-11461A vulnerability has been found in NousResearch hermes-agent …6.3
• CVE-2026-114610fpdf2 is a PDF creation library for Python. From 2.5.0 until…6.5
• CVE-2026-114611OCO-Server is a self-hosted endpoint management application …9.1