---
id: CVE-2026-114606
title: >-
  draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path
  gate)
summary: >-
  draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4,
  draw.io Desktop is vulnerable to arbitrary local-file disclosure through the
  Electron main process's read-side IPC handlers. The readFile, getFileDrafts,
  getBkpF…
severity: medium
cvss: 5.6
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-22
  - CWE-200
vendor: jgraph
product: drawio-desktop
affected:
  - drawio-desktop < 31.4.4
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T16:35:34.251Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114606'
references:
  - url: >-
      https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-fjgc-8xgj-rvh4
    label: >-
      https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-fjgc-8xgj-rvh4
  - url: >-
      https://github.com/jgraph/drawio-desktop/commit/9c933514b8bcc90a91d88c685525a8885de4027e
    label: >-
      https://github.com/jgraph/drawio-desktop/commit/9c933514b8bcc90a91d88c685525a8885de4027e
  - url: 'https://github.com/jgraph/drawio-desktop/releases/tag/v31.4.4'
    label: 'https://github.com/jgraph/drawio-desktop/releases/tag/v31.4.4'
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.345Z'
---

## Overview

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFile actions operate on a renderer-chosen filesystem path with no blessed-path (assertWritablePath) authorization. The only gates are validateSender — a URL-prefix origin check — plus, for readFile alone, a content "sniff" and a lexical appBaseDir prefix block. The write-side handlers (saveFile, writeFile, saveDraft, deleteFile) are all protected by assertWritablePath; the read side is not. The result is a read/write authorization asymmetry: any frame executing in the app's file:// origin can read the contents of local files that the same origin is explicitly forbidden to write. This issue is fixed in version 31.4.4.

## Affected

- `drawio-desktop < 31.4.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.