Live › vulnerability › CVE-2026-114606
Go to dashboarddraw.io Desktop's Electron main process exposes several read-side IPC handlers that accept any filesystem path chosen by the renderer, with no authorization check. A frame running in the app's file:// origin can therefore read local files the app would never allow it to write.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that install draw.io Desktop on workstations or shared machines are exposed, since the flaw needs a frame running in the app's origin to read local files. Users who only use the web app at diagrams.net or a managed hosted instance are not affected by this desktop build.
No product ranges from the sources yet.
draw.io --version or check the installed draw.io Desktop version in the About dialog; versions below 31.4.4 are affected.31.4.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFile actions operate on a renderer-chosen filesystem path with no blessed-path (assertWritablePath) authorization. The only gates are validateSender — a URL-prefix origin check — plus, for readFile alone, a content "sniff" and a lexical appBaseDir prefix block. The write-side handlers (saveFile, writeFile, saveDraft, deleteFile) are all protected by assertWritablePath; the read side is not. The result is a read/write authorization asymmetry: any frame executing in the app's file:// origin can read the contents of local files that the same origin is explicitly forbidden to write. This issue is fixed in version 31.4.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-114606")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.