{"id":"CVE-2026-114606","title":"draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)","summary":"draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpF…","severity":"medium","cvss":5.6,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-22","CWE-200"],"vendor":"jgraph","product":"drawio-desktop","affected":["drawio-desktop < 31.4.4"],"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T16:35:34.251Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114606","references":[{"url":"https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-fjgc-8xgj-rvh4","label":"https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-fjgc-8xgj-rvh4"},{"url":"https://github.com/jgraph/drawio-desktop/commit/9c933514b8bcc90a91d88c685525a8885de4027e","label":"https://github.com/jgraph/drawio-desktop/commit/9c933514b8bcc90a91d88c685525a8885de4027e"},{"url":"https://github.com/jgraph/drawio-desktop/releases/tag/v31.4.4","label":"https://github.com/jgraph/drawio-desktop/releases/tag/v31.4.4"}],"tags":["cve.org"],"ingestedAt":"2026-10-22T22:00:50.345Z","slug":"CVE-2026-114606","body":"## Overview\n\ndraw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFile actions operate on a renderer-chosen filesystem path with no blessed-path (assertWritablePath) authorization. The only gates are validateSender — a URL-prefix origin check — plus, for readFile alone, a content \"sniff\" and a lexical appBaseDir prefix block. The write-side handlers (saveFile, writeFile, saveDraft, deleteFile) are all protected by assertWritablePath; the read side is not. The result is a read/write authorization asymmetry: any frame executing in the app's file:// origin can read the contents of local files that the same origin is explicitly forbidden to write. This issue is fixed in version 31.4.4.\n\n## Affected\n\n- `drawio-desktop < 31.4.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":30.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}